feat(docker): restore in-app self-update in the Compose dep

[opticon454]

Codeman running under docker/docker-compose.yaml lost the ability to update itself from App Settings -> Updates. The image had no .git (excluded by .dockerignore), so the install reported as "unknown"; there was no init system for detectSupervisor() to find; the runtime stage had neither devDependencies nor a build toolchain; and a pull into the baked /opt/codeman would have landed in the container's writable layer and been discarded by the next up.

Restore it through configuration rather than a second updater, so the release channel, auto-stash, status file and boot reconcile are all reused unchanged:

• The checkout Compose builds from is bind-mounted over /opt/codeman, so the update's git checkout and rebuild land on the host and survive recreation.
• The restart is the server exiting; restart: unless-stopped relaunches the container on the new dist/. This is the one supervisor whose updater does NOT outlive the restart, which is safe only because the terminal "restarting" marker is written first.
• node_modules and dist are named volumes over the bind mount, so container-compiled native modules never enter the host checkout.
• The runtime image keeps devDependencies and gains python3/make/g++, since npm run build is tsc + esbuild and node-pty has no Linux prebuild.

An in-place container update applies code only, because a restart reuses the existing image and config. evaluateEnvironmentGate() reads the target release's own files with git show <tag>:<path> and refuses when server.Dockerfile or docker-compose.yaml changed, when .env.example gained keys the user's .env lacks, or when the restart policy would not bring the container back. The missing-key check matters most: Compose resolves an unset ${VAR} to the empty string and starts anyway, so a new required setting would otherwise arrive as a silently blank variable. Every unknown fails open, and the gate is re-evaluated server-side on POST /api/system/update.

The four global agent CLIs are pinned, because an unpinned CLI bump is the one environment change no diff-derived gate can see; pinning turns it into a Dockerfile change the gate already detects.

Adds test/docker-compose-env-parity.test.ts as the merge-side guard (every compose ${VAR} has an .env.example entry and the reverse) and test/docker-self-update.test.ts for the pure gate decisions.

Documented in docs/docker-self-update.md.

[Ark0N]

Merged, thank you. This is a clean way to get updates back without a second updater, and the env-keys check is the part I would not have thought to add. I built the image from the merged tree (2.64 GB, classic builder), checked it runs as the unprivileged user with tsc/esbuild, the toolchain and the four pinned CLIs in place and no docker/.env baked in, and confirmed docker inspect $HOSTNAME answers the restart policy through the mounted socket as that user. Full gate green on the merge (334 files, 6512 tests).

One change went in right behind it (99ad9cb), and I want to explain it rather than bury it. The gate failing open on an unknown restart policy is right, but the kill inherited that: with no socket the script exited the server regardless, and a container nothing restarts (a plain docker run of this image without --restart, which takes the container path because the image sets CODEMAN_IN_CONTAINER=1 itself) goes down with no UI left to recover it. The decision now happens server-side and rides down as --restart-by-exit 0|1: 1 when the Compose file declares CODEMAN_RESTART_BY_EXIT=1 (added there and only there, since that file is what sets restart: unless-stopped) or the daemon confirms an auto-restart policy, otherwise the build lands as completed-needs-manual-restart with the docker restart hint. The shipped deployment behaves exactly as you designed it. Same commit chowns the fingerprint baseline's .codeman dir to PUID:PGID when Start-Codeman.sh runs as root, since on a first start it would otherwise be created root-owned before the container ever gets to it.

Follow-ups, none blocking:

• ~600 MB of the image is devDependencies the build never needs (remotion, rspack, rolldown, changesets, playwright-core). Since the updater runs npm install --include=dev anyway, keeping npm prune --omit=dev in the image and letting the first in-app update fetch them into the named volume would give most of that back.
• The pins are already a step behind npm (claude 2.1.258 vs 2.1.260, codex 0.152.1 vs 0.153.2, opencode 1.18.26 vs 1.18.27). Fine, and it proves the point of pinning; worth a bump line in the release checklist.
• The changeset is marked minor; it will get folded into the next release note like the others.