fix: remaining npm→pnpm gaps + dockerignore for pnpm symlinks

- container/.dockerignore (new): exclude agent-runner/node_modules and
  agent-runner/dist so COPY agent-runner/ ./ doesn't clobber the
  pnpm-installed node_modules with host directories. Under npm's flat
  layout this was forgiving; under pnpm's symlink layout it's a hard
  conflict (overlay2 cannot copy onto a symlink target).
- setup/{groups,service}.ts: execSync('pnpm run build') not npm.
- setup/index.ts: usage string.
- scripts/*.ts: usage comments + seed-discord final log.
- .claude/settings.json: permission allowlist entries.
- .claude/skills/{add-whatsapp-v2,add-dashboard}/SKILL.md: docs.
- container/skills/{frontend-engineer,vercel-cli,self-customize}/SKILL.md:
  agent-facing docs still told the container agent to run npm.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -6,17 +6,17 @@
     "allow": [
       "Bash(bash setup.sh*)",
       "Bash(git remote *)",
-      "Bash(npx tsx setup/index.ts*)",
-      "Bash(npx tsx scripts/init-first-agent.ts*)",
-      "Bash(npm install @chat-adapter/*)",
-      "Bash(npm install chat-adapter-imessage*)",
-      "Bash(npm install @bitbasti/chat-adapter-webex*)",
-      "Bash(npm install @resend/chat-sdk-adapter*)",
-      "Bash(npm install @whiskeysockets/baileys*)",
-      "Bash(npm install @beeper/chat-adapter-matrix*)",
-      "Bash(npm install @nanoco/nanoclaw-dashboard*)",
-      "Bash(npm ci*)",
-      "Bash(npm run build*)",
+      "Bash(pnpm exec tsx setup/index.ts*)",
+      "Bash(pnpm exec tsx scripts/init-first-agent.ts*)",
+      "Bash(pnpm install @chat-adapter/*)",
+      "Bash(pnpm install chat-adapter-imessage*)",
+      "Bash(pnpm install @bitbasti/chat-adapter-webex*)",
+      "Bash(pnpm install @resend/chat-sdk-adapter*)",
+      "Bash(pnpm install @whiskeysockets/baileys*)",
+      "Bash(pnpm install @beeper/chat-adapter-matrix*)",
+      "Bash(pnpm install @nanoco/nanoclaw-dashboard*)",
+      "Bash(pnpm install --frozen-lockfile*)",
+      "Bash(pnpm run build*)",
       "Bash(curl -fsSL onecli.sh*)",
       "Bash(onecli *)",
       "Bash(grep -q *)",