fix: migrate container agent-runner to pnpm with proper build scripts

- Remove package-lock.json, add pnpm-lock.yaml for frozen installs
- Add pnpm-workspace.yaml with onlyBuiltDependencies (better-sqlite3)
  and minimumReleaseAge matching root project policy
- Dockerfile: allow agent-browser build scripts via global .npmrc
  (global installs don't read project-level workspace config)
- Dockerfile: make lockfile and workspace COPY mandatory (drop glob)

container/Dockerfile

@@ -35,14 +35,15 @@ ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
 
-# Install agent-browser and claude-code globally
+# Allow agent-browser build scripts for global install, then install
-RUN pnpm install -g agent-browser @anthropic-ai/claude-code vercel
+RUN echo "only-built-dependencies[]=agent-browser" > /root/.npmrc && \
+    pnpm install -g agent-browser @anthropic-ai/claude-code vercel
 
 # Create app directory
 WORKDIR /app
 
 # Copy package files first for better caching
-COPY agent-runner/package.json agent-runner/pnpm-lock.yaml* ./
+COPY agent-runner/package.json agent-runner/pnpm-lock.yaml agent-runner/pnpm-workspace.yaml ./
 
 # Install dependencies
 RUN pnpm install --frozen-lockfile

container/agent-runner/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+onlyBuiltDependencies:
+  - better-sqlite3
+
+pnpm:
+  minimumReleaseAge: 4320