feat(backends,storage,core,markdown,infra): claude agent sdk backend, session store, transcript seeding, runner isolation

Dockerfile

@@ -44,26 +44,22 @@ RUN apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates git \
  && rm -rf /var/lib/apt/lists/*
 
-# Bun native binary (glibc) — fast `npm install` replacement, only used
-# to drop the claude CLI into the image. Not invoked at runtime.
+# Bun native binary (glibc): `bunx` runs the stdio MCP servers declared in
+# the user's config. The claude CLI itself ships inside the
+# claude-agent-sdk wheel (`_bundled/claude`), nothing to install here.
 COPY --from=oven/bun:1-slim /usr/local/bin/bun /usr/local/bin/bun
 RUN ln -s /usr/local/bin/bun /usr/local/bin/bunx
 
-# `--trust` is required: without it bun skips the postinstall step that
-# fetches claude's native binary (anthropics/claude-code#50203). The
-# postinstall itself is bun's smoke check — if it fails the layer
-# fails. We deliberately DO NOT run `claude --version` here: claude
-# touches `$HOME` on every invocation (creates `/root/.claude/`,
-# `/root/.claude.json`, sometimes `/root/.config/claude/`), and those
-# build-time artifacts seed the runtime named-volume `claude-home`
-# with stale "haven't onboarded" state, so the user gets re-prompted
-# for trust/bypass dialogs on every rebuild and the subscription auth
-# can land on a tainted credential file.
-ENV BUN_INSTALL=/usr/local/bun-global \
-    PATH=/usr/local/bun-global/bin:/app/.venv/bin:$PATH
-RUN bun install -g --trust @anthropic-ai/claude-code \
- && test -x "$(command -v claude)" \
- && rm -rf /root/.claude /root/.claude.json /root/.config/claude
+# The model process runs as `beaver-runner`, not as the gateway: the
+# adapter spawns claude under this uid with a whitelisted environment.
+# `acl` lets the entrypoint grant it write access to the vault sub-mounts
+# without chowning files that Obsidian Sync keeps rewriting as root.
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends acl \
+ && rm -rf /var/lib/apt/lists/* \
+ && useradd --system --uid 1001 --create-home --shell /usr/sbin/nologin beaver-runner
+
+ENV PATH=/app/.venv/bin:$PATH
 
 COPY --from=builder /app/.venv /app/.venv
 COPY --from=builder /app /app