feat(v2): builder-agent self-modification WIP + container-config as per-group file

Checkpoints the builder-agent dev-agent/worktree/swap flow (create_dev_agent,
request_swap, classifier, deadman, promote) before pivoting to a unified
draft-activate approach with OS-level RO enforcement. Lifts container_config
out of the agent_groups row into groups/<folder>/container.json so install_packages,
add_mcp_server, and rebuild flows can eventually route through the same draft
path as source edits.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/host-core.test.ts

@@ -70,7 +70,6 @@ describe('session manager', () => {
       name: 'Test Agent',
       folder: 'test-agent',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     createMessagingGroup({
@@ -185,7 +184,6 @@ describe('router', () => {
       name: 'Test Agent',
       folder: 'test-agent',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     // Use 'public' policy so the router tests exercise routing, not the
@@ -308,7 +306,6 @@ describe('delivery', () => {
       name: 'Agent',
       folder: 'agent',
       agent_provider: null,
-      container_config: null,
       created_at: now(),
     });
     createMessagingGroup({