feat(v2): builder-agent self-modification WIP + container-config as per-group file

Checkpoints the builder-agent dev-agent/worktree/swap flow (create_dev_agent,
request_swap, classifier, deadman, promote) before pivoting to a unified
draft-activate approach with OS-level RO enforcement. Lifts container_config
out of the agent_groups row into groups/<folder>/container.json so install_packages,
add_mcp_server, and rebuild flows can eventually route through the same draft
path as source edits.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/db/db-v2.test.ts

@@ -66,7 +66,6 @@ describe('agent groups', () => {
     name: 'Test Agent',
     folder: 'test-agent',
     agent_provider: null,
-    container_config: null,
     created_at: now(),
   });
 
@@ -163,7 +162,6 @@ describe('messaging group agents', () => {
       name: 'Agent',
       folder: 'agent',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     createMessagingGroup({
@@ -202,7 +200,6 @@ describe('messaging group agents', () => {
       name: 'Agent2',
       folder: 'agent2',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     createMessagingGroupAgent({ ...mga(), id: 'mga-2', agent_group_id: 'ag-2', priority: 10 });
@@ -285,7 +282,6 @@ describe('sessions', () => {
       name: 'Agent',
       folder: 'agent',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     createMessagingGroup({
@@ -380,7 +376,6 @@ describe('pending questions', () => {
       name: 'Agent',
       folder: 'agent',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     createSession({