make -one-shot command line work with both -unsafe and regular

The "-one" option had atrophied in a variety of ways, against both
unsafe and dockerized environments. I resurrected it, and simplified
the flag handling slightly by using just one flag.
diff --git a/dockerimg/dockerimg.go b/dockerimg/dockerimg.go
index a787114..e40a77b 100644
--- a/dockerimg/dockerimg.go
+++ b/dockerimg/dockerimg.go
@@ -76,6 +76,9 @@
 	OutsideHostname   string
 	OutsideOS         string
 	OutsideWorkingDir string
+
+	// If not empty, handle this message and exit
+	OneShot string
 }
 
 // LaunchContainer creates a docker container for a project, installs sketch and opens a connection to it.
@@ -439,6 +442,9 @@
 	if config.SkabandAddr != "" {
 		cmdArgs = append(cmdArgs, "-skaband-addr="+config.SkabandAddr)
 	}
+	if config.OneShot != "" {
+		cmdArgs = append(cmdArgs, "-one-shot", config.OneShot)
+	}
 	if out, err := combinedOutput(ctx, "docker", cmdArgs...); err != nil {
 		return fmt.Errorf("docker create: %s, %w", out, err)
 	}