fix: harden container config DB layer

- config-add/remove-package now rebuild image + restart containers
- Deduplicate packages in self-mod install_packages handler
- Add runtime whitelist guards for SQL column interpolation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/cli/resources/groups.ts

@@ -1,4 +1,5 @@
 import type { McpServerConfig } from '../../container-config.js';
+import { buildAgentGroupImage } from '../../container-runner.js';
 import { restartAgentGroupContainers } from '../../container-restart.js';
 import {
   getContainerConfig,
@@ -186,6 +187,9 @@ registerResource({
           }
         }
 
+        await buildAgentGroupImage(id);
+        restartAgentGroupContainers(id, 'package added via ncl');
+
         return { added: { apt: apt || null, npm: npm || null } };
       },
     },
@@ -214,6 +218,9 @@ registerResource({
           updateContainerConfigJson(id, 'packages_npm', filtered);
         }
 
+        await buildAgentGroupImage(id);
+        restartAgentGroupContainers(id, 'package removed via ncl');
+
         return { removed: { apt: apt || null, npm: npm || null } };
       },
     },