feat(setup): per-checkout service name and docker image tag

Two NanoClaw installs on the same host used to fight over the shared `com.nanoclaw` launchd label / `nanoclaw.service` systemd unit and the `nanoclaw-agent:latest` docker tag — the second install silently rewrote the service pointer and rebuilt the image out from under the first. Introduces a deterministic per-checkout slug (sha1(projectRoot)[:8]) and namespaces everything off it:

- Service: `com.nanoclaw-v2-<slug>` / `nanoclaw-v2-<slug>.service`
- Image:   `nanoclaw-agent-v2-<slug>:latest` (base), `nanoclaw-agent-v2-<slug>:<agentGroupId>` (per-group)

New shared helpers: src/install-slug.ts (host) + setup/lib/install-slug.sh (bash). Both compute the same slug so verify/probe/add-*.sh/build.sh/container-runner all agree. Any v1 `com.nanoclaw` service left on the host stays untouched and can coexist.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/lib/install-slug.sh

@@ -0,0 +1,37 @@
+# install-slug.sh — shell mirror of setup/lib/install-slug.ts.
+#
+# Source this file after $PROJECT_ROOT is set:
+#
+#   source "$PROJECT_ROOT/setup/lib/install-slug.sh"
+#   label=$(launchd_label)        # com.nanoclaw-v2-<slug>
+#   unit=$(systemd_unit)          # nanoclaw-v2-<slug>
+#   image=$(container_image_base) # nanoclaw-agent-v2-<slug>
+#
+# Slug is sha1(PROJECT_ROOT)[:8] — must match the TS helper exactly so both
+# halves of setup name things consistently.
+
+_nanoclaw_install_slug() {
+  local root="${NANOCLAW_PROJECT_ROOT:-${PROJECT_ROOT:-$PWD}}"
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$root" | shasum | cut -c 1-8
+  elif command -v sha1sum >/dev/null 2>&1; then
+    printf '%s' "$root" | sha1sum | cut -c 1-8
+  else
+    # Fallback: hash the path with something deterministic-ish. Not ideal —
+    # but shasum is present on every modern macOS/Linux, so this is just
+    # belt-and-braces against a truly minimal system.
+    printf '%s' "$root" | od -An -tx1 | tr -d ' \n' | cut -c 1-8
+  fi
+}
+
+launchd_label() {
+  printf 'com.nanoclaw-v2-%s' "$(_nanoclaw_install_slug)"
+}
+
+systemd_unit() {
+  printf 'nanoclaw-v2-%s' "$(_nanoclaw_install_slug)"
+}
+
+container_image_base() {
+  printf 'nanoclaw-agent-v2-%s' "$(_nanoclaw_install_slug)"
+}