fix(container-runner): skip broken nested file mounts on Apple Container

[jurre-mbt-it]

Summary

The nested file mounts for container.json and the composed CLAUDE.md produce phantom inodes on Apple Container — stat() returns mode 0644 but reads return EACCES even as root. This silently disables every MCP server configured via ncl groups config add-mcp-server and skips composed CLAUDE.md context for every Apple Container user.

Discovered while wiring a new MCP server on a v2.0.70 install. Symptom: agent answered "I don't have access to that data" while the configured MCP server was sitting unreached. From inside the container:

$ container exec --user 0:0 <container> sh -c 'stat /workspace/agent/container.json; cat /workspace/agent/container.json'
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
cat: /workspace/agent/container.json: Permission denied

stat lies. The kernel returns EACCES regardless of POSIX bits because Apple Container's virtio-fs doesn't support the "file mount on top of a dir mount" pattern that works on Docker.

Impact (when unpatched on Apple Container)

• All ncl groups config add-mcp-server entries are silently ignored — loadConfig() falls back to all-empty defaults.
• Composed CLAUDE.md (skill instructions, fragments, on-wake messages) doesn't reach the agent.
• Existing chat keeps working because CLAUDE.local.md lives in the always-OK dir-mount-only file.

Users discover this only when they try to use a feature that depends on MCP tools — the agent improvises around the missing capability rather than erroring.

Fix

Remove both nested file mounts. The dir mount at /workspace/agent already exposes both files. The host re-materializes both from the central DB / composer on every container spawn, so any in-container writes are clobbered next session — the read-only intent is preserved in practice.

Follow-up

A separate PR adds a startup retry to agent-runner/src/config.ts for a related virtio-fs race that surfaces once these mounts are skipped (first read can still fail with ENOENT because the nested dir mount takes ~100–500 ms to expose on Apple Container).

Suggested upstream-quality version

If preserving the read-only guarantee with defense-in-depth matters, detect the runtime at host startup and only skip the nested mounts on Apple Container:

const isAppleContainer = process.env.CONTAINER_RUNTIME_BIN === 'container'
                      || detectAppleContainerRuntime();
if (!isAppleContainer) {
  mounts.push({ hostPath: containerJsonPath, containerPath: '/workspace/agent/container.json', readonly: true });
  mounts.push({ hostPath: composedClaudeMd, containerPath: '/workspace/agent/CLAUDE.md', readonly: true });
}

Happy to rework this PR into that shape if you'd prefer — let me know.

Test plan

• Spawn an agent container on Apple Container; confirm container exec ... cat /workspace/agent/container.json succeeds.
• Confirm same for /workspace/agent/CLAUDE.md.
• Configure an MCP server via ncl groups config add-mcp-server and send a message that should trigger it — agent should actually call the tool.
• Spawn an agent container on Docker; verify no regression (both files still readable; behavior unchanged).

🤖 Generated with Claude Code