fix: move _generate_local_model_services before CLAUDE_BIN_PLACEHOLDER sed pass

The placeholder substitution ran before local-model services were appended,
leaving a literal CLAUDE_BIN_PLACEHOLDER in the compose file. Reorder so
the sed pass runs after all services (including local-model) are in place.

Also adds the `g` flag to the sed substitution so it replaces all occurrences,
and aligns the .ssh volume mount escaping with the other ${HOME} references.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/generators.sh

@@ -69,7 +69,7 @@ _generate_local_model_services() {
       - \${HOME}/.claude:/home/agent/.claude
       - \${HOME}/.claude.json:/home/agent/.claude.json:ro
       - CLAUDE_BIN_PLACEHOLDER:/usr/local/bin/claude:ro
-      - ${HOME}/.ssh:/home/agent/.ssh:ro
+      - \${HOME}/.ssh:/home/agent/.ssh:ro
     environment:
       FORGE_URL: http://forgejo:3000
       FORGE_TOKEN: \${FORGE_TOKEN:-}
@@ -392,18 +392,6 @@ COMPOSEEOF
   # (Docker Compose cannot resolve it; it's a shell variable, not a .env var)
   sed -i "s|\${PROJECT_NAME:-project}|${PROJECT_NAME}|g" "$compose_file"
 
-  # Patch the Claude CLI binary path — resolve from host PATH at init time.
-  local claude_bin
-  claude_bin="$(command -v claude 2>/dev/null || true)"
-  if [ -n "$claude_bin" ]; then
-    # Resolve symlinks to get the real binary path
-    claude_bin="$(readlink -f "$claude_bin")"
-    sed -i "s|CLAUDE_BIN_PLACEHOLDER|${claude_bin}|" "$compose_file"
-  else
-    echo "Warning: claude CLI not found in PATH — update docker-compose.yml volumes manually" >&2
-    sed -i "s|CLAUDE_BIN_PLACEHOLDER|/usr/local/bin/claude|" "$compose_file"
-  fi
-
   # Patch the forgejo port mapping into the file if non-default
   if [ "$forge_port" != "3000" ]; then
     # Add port mapping to forgejo service so it's reachable from host during init
@@ -413,8 +401,22 @@ COMPOSEEOF
   fi
 
   # Append local-model agent services if any are configured
+  # (must run before CLAUDE_BIN_PLACEHOLDER substitution so the placeholder
+  # in local-model services is also resolved)
   _generate_local_model_services "$compose_file"
 
+  # Patch the Claude CLI binary path — resolve from host PATH at init time.
+  local claude_bin
+  claude_bin="$(command -v claude 2>/dev/null || true)"
+  if [ -n "$claude_bin" ]; then
+    # Resolve symlinks to get the real binary path
+    claude_bin="$(readlink -f "$claude_bin")"
+    sed -i "s|CLAUDE_BIN_PLACEHOLDER|${claude_bin}|g" "$compose_file"
+  else
+    echo "Warning: claude CLI not found in PATH — update docker-compose.yml volumes manually" >&2
+    sed -i "s|CLAUDE_BIN_PLACEHOLDER|/usr/local/bin/claude|g" "$compose_file"
+  fi
+
   echo "Created: ${compose_file}"
 }