feat: portable derivation on the container driver (#252) - #280

The app owns the host descriptor's schema (#249), but nothing could
write one. `workroom host set --project P [--workroom W] DESCRIPTOR`
stores a JSON object verbatim as the project's or workroom's "host",
and `host clear` removes it. #252 records a project's base machine
this way.

It never creates an entry: an unknown project or workroom is refused
(ProjectNotFound, WorkroomNotFound), and so is a descriptor that isn't
an object (InvalidHostDescriptor), JSON null included, which would
otherwise turn a remote workroom local. The command is hidden; it is
plumbing for the app. The new error kinds are additive, so
schema_version stays 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Slice B of #252: the portable creation sequence, in RemoteProvisioning.

A base is provisioned, its repository cloned through the agent's exec
service, and recorded through a caller's closure (`workroom host set`,
via the new WorkroomCLI.setHost). The clone uses a one-shot read-only
token from the broker (BrokerClient.baseCloneToken). It reaches git only
as an Authorization header for github.com in the exec request's
environment (GIT_CONFIG_COUNT), never in an argument, the remote URL or
a file, and it is revoked at GitHub once the clone is over. The base
never enrols. refreshBase fetches with a fresh token.

A workroom runs derive, then enrol (AgentEnrolment, so each key is its
own), then fetch and check out its own branch from origin/HEAD, and is
returned serving. A failure at any step cancels the grant and destroys
the instance; a failed base build destroys the base and revokes its
token.

The fixture image now carries a seeded /srv/origin.git for the base to
clone by path, since the fixture has no GitHub.

Tests: 5 RemoteProvisioningIntegrationTests through run.sh, plus unit
tests for the clone environment and the token request. The full app
suite passes through the fixture (3108 passed, one pre-existing eval
skip), and so do the 5 over_ssh Rust tests. Three negative controls go
red: dropping the grant cancel, dropping the instance destroy, and
passing the token as `clone -c`, which the disk search finds in
.git/config.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… reboot

Part of Slice C of #252. The container driver now publishes each
container's ssh on a loopback port chosen for it, rather than an
ephemeral one, so a restart keeps the host's address the way a
provider's box keeps its own. With its identity kept too, a pane's ssh
gets back in with the host key pinned at the derive.

The new test writes a screen on a derived workroom, stops and starts
its container, and reattaches. The pane shows the last screen with the
"ended when its host restarted" notice: the derived image keeps the
fixture's supervisor, which passes --screens on a directory in the home
directory, not on tmpfs /run. Removing --screens turns the test red.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…onnected

The rest of Slice C of #252. The fixture gains a GitHub and a broker of
its own (fake-github.py, started by the entrypoint as the ssh user with
only CAP_NET_BIND_SERVICE):

- The broker, on http://127.0.0.1:8081, accepts an enrolment and mints
  a token per request.
- GitHub, on https://github.com, mapped to the container's loopback,
  with a certificate git trusts for that host only. It serves git's
  smart HTTP through git-http-backend over /srv. Without a token it
  minted, or the base clone token baked into the image, it answers 401
  with a Basic challenge.

The test clones the base over https with the broker's clone token as
git's header, derives and enrols a workroom against the box's own
broker, and closes the Mac's connection. Then, through the runtime's
exec rather than the Mac's link, it shows the workroom fetching and
pushing on its own, its credential helper minting from the box's
broker. A push with the helper switched off is refused, inside the
test. Deleting the workroom's enrolment makes the fetch and push fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

From an independent review of this branch (macapp/AGENTS.md rule 3):

- The container driver names what it makes. A run is named
  workroom-<host id>, and a commit carries a workroom.commit label
  chosen first. A run or commit that outlives its CLI (killed by the
  silence bound, or a cancelled derive) is then still found and
  removed; before, its ID was known only from output nobody read.
  Commits get a 900 s silence bound, since commit prints nothing until
  it is done. The failure tests now also fail each step after the
  daemon has done it.
- An instance can't be derived from: its disk holds its key and
  credential helper. The entrypoint's re-mint also deletes the agent's
  interrupted saves (.broker.json.<pid>), which can hold a key.
- Destroying a workroom destroys its box even when the broker can't
  cancel the grant. The key that would mint against the grant goes
  with the box. The first error is still thrown.
- `host set` decodes with UseNumber, as Config.Read does, so an integer
  above 2^53 is stored as written. It also refuses trailing data.
- The base test clones over https, so the token-on-disk and remote-URL
  checks run where git really sends the token.
- gitTimeout's comment called it a silence bound; the agent's exec
  deadline is a wall clock capped at 610 s. Recorded as a ceiling: a
  clone over 10 minutes fails.

The design doc gains an "As built (#252)" section with the gaps left
for #253, #256 and #257. macapp/AGENTS.md now says what writes a host
descriptor.

Negative controls went red for each fix. Full app suite through the
fixture: 3111 passed, 0 failed. Also passing: Rust over_ssh (5), go
test, cli-lint, app-lint, app-test-scripts, shellcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

From /review (specialists, Red Team, Claude and Codex adversarial passes):

- delete-project refuses a project whose own host descriptor is set,
  in every mode. That descriptor is a base machine's only record; the
  old guard checked only workroom descriptors, so it orphaned the box.
- derive and buildBase throw Failure.rollbackIncomplete, naming the
  host and grant still live, when undoing a failed step fails too.
  Before, the cleanup errors were swallowed and nothing recorded what
  was left running.
- BaseLocks serialises a derive's snapshot, a refresh and a destroy per
  base. docker commit freezes git mid-fetch, so a snapshot taken during
  a refresh would hand its .lock files to every workroom derived from
  it. A caller cancelled while it waits gives the base up.
- Fetching runs `git remote set-head origin --auto`, and checkout uses
  refs/remotes/origin/HEAD. fetch never moves origin/HEAD, so after the
  remote renamed its default branch every derive failed.
- `host set|clear` honours --pretend, still checking that the entry
  exists. The commit sweep reads every line of output, and a failed run
  removes the host's ssh directory.
- New tests: delete-project with a base, the host CLI's JSON envelope
  and --pretend, destroy with a failed grant cancel, destroyBase, a
  refused clone token, a rollback that fails, concurrent derives, a
  renamed default branch, and the per-base lock. Each was shown red
  without its fix. run.sh exports the fixture's clone token and broker
  URL.

Full app suite through the fixture: 3119 passed, 0 failed. Also passing:
Rust over_ssh (5), go test, cli-lint, app-lint, app-test-scripts (17)
and shellcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>