fix: remaining npm→pnpm gaps + dockerignore for pnpm symlinks

- container/.dockerignore (new): exclude agent-runner/node_modules and
  agent-runner/dist so COPY agent-runner/ ./ doesn't clobber the
  pnpm-installed node_modules with host directories. Under npm's flat
  layout this was forgiving; under pnpm's symlink layout it's a hard
  conflict (overlay2 cannot copy onto a symlink target).
- setup/{groups,service}.ts: execSync('pnpm run build') not npm.
- setup/index.ts: usage string.
- scripts/*.ts: usage comments + seed-discord final log.
- .claude/settings.json: permission allowlist entries.
- .claude/skills/{add-whatsapp-v2,add-dashboard}/SKILL.md: docs.
- container/skills/{frontend-engineer,vercel-cli,self-customize}/SKILL.md:
  agent-facing docs still told the container agent to run npm.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/groups.ts

@@ -87,7 +87,7 @@ async function syncGroups(projectRoot: string): Promise<void> {
   log.info('Building TypeScript');
   let buildOk = false;
   try {
-    execSync('npm run build', {
+    execSync('pnpm run build', {
       cwd: projectRoot,
       stdio: ['ignore', 'pipe', 'pipe'],
     });

setup/index.ts

@@ -1,6 +1,6 @@
 /**
  * Setup CLI entry point.
- * Usage: npx tsx setup/index.ts --step <name> [args...]
+ * Usage: pnpm exec tsx setup/index.ts --step <name> [args...]
  */
 import { log } from '../src/log.js';
 import { emitStatus } from './status.js';
@@ -27,7 +27,7 @@ async function main(): Promise<void> {
 
   if (stepIdx === -1 || !args[stepIdx + 1]) {
     console.error(
-      `Usage: npx tsx setup/index.ts --step <${Object.keys(STEPS).join('|')}> [args...]`,
+      `Usage: pnpm exec tsx setup/index.ts --step <${Object.keys(STEPS).join('|')}> [args...]`,
     );
     process.exit(1);
   }

setup/service.ts

@@ -31,7 +31,7 @@ export async function run(_args: string[]): Promise<void> {
   // Build first
   log.info('Building TypeScript');
   try {
-    execSync('npm run build', {
+    execSync('pnpm run build', {
       cwd: projectRoot,
       stdio: ['ignore', 'pipe', 'pipe'],
     });