refactor: remove host-mode reviewer, container-only

Reviewer always runs in Docker container. No more snapshot file copy —
reviewer mounts the owner workspace directly as read-only. Removes
REVIEWER_CONTAINER_ENABLED toggle and host-mode fallback code.

src/agent-runner.ts

@@ -70,13 +70,9 @@ export async function runAgentProcess(
   envOverrides?: Record<string, string>,
 ): Promise<AgentOutput> {
   // ── Reviewer container mode ─────────────────────────────────────
-  // When EJCLAW_REVIEWER_RUNTIME is set in envOverrides, run the reviewer
+  // Reviewers always run inside a Docker container with read-only source
-  // inside a Docker container with read-only source mount instead of
+  // mount for kernel-level write protection. Docker is required.
-  // as a host process. This provides kernel-level write protection.
+  if (envOverrides?.EJCLAW_REVIEWER_RUNTIME === '1') {
-  const isReviewerContainer =
-    envOverrides?.EJCLAW_REVIEWER_RUNTIME === '1' &&
-    getEnv('REVIEWER_CONTAINER_ENABLED') !== '0';
-  if (isReviewerContainer) {
     const ownerWorkspaceDir =
       envOverrides?.EJCLAW_WORK_DIR || group.workDir || process.cwd();
     return runReviewerContainer({

src/paired-workspace-manager.ts

@@ -537,9 +537,23 @@ export function markPairedTaskReviewReady(taskId: string): {
   if (!ownerWorkspace) {
     return null;
   }
-  const reviewerWorkspace = refreshReviewerSnapshotForPairedTask(taskId);
-  const now = new Date().toISOString();
 
+  // Reviewer runs in a container with the owner workspace mounted read-only.
+  // No file-level snapshot copy needed — just register the path.
+  const reviewerWorkspace = makeWorkspaceRecord({
+    taskId,
+    role: 'reviewer',
+    workspaceDir: ownerWorkspace.workspace_dir,
+    snapshotSourceDir: ownerWorkspace.workspace_dir,
+    snapshotRefreshedAt: requestedAt,
+  });
+  upsertPairedWorkspace(reviewerWorkspace);
+  logger.info(
+    { taskId, ownerDir: ownerWorkspace.workspace_dir },
+    'Reviewer will mount owner workspace directly',
+  );
+
+  const now = new Date().toISOString();
   updatePairedTask(taskId, {
     status: 'review_ready',
     updated_at: now,