fix: Containerize full stack with docker-compose (#618)

Add docker-compose.yml generation, agent Dockerfile, and new CLI
commands (up/down/logs/shell) so the full stack runs containerized.
The --bare flag preserves the current bare-metal setup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker/agents/Dockerfile

@@ -0,0 +1,20 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bash curl git jq tmux cron python3 openssh-client ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Claude CLI
+RUN curl -fsSL https://cli.anthropic.com/install.sh | sh \
+    && mv /root/.claude/local/claude /usr/local/bin/claude || true
+
+# Non-root user
+RUN useradd -m -u 1000 -s /bin/bash agent
+
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+USER agent
+WORKDIR /home/agent
+
+ENTRYPOINT ["/entrypoint.sh"]