refactor: dual-instance setup, remove dead container code

- Make STORE_DIR, DATA_DIR, GROUPS_DIR configurable via env vars
  (NANOCLAW_STORE_DIR, NANOCLAW_DATA_DIR, NANOCLAW_GROUPS_DIR)
  for running two instances from one codebase
- Remove broken 'both' agent type sequential loop from processGroupMessages
- Delete dead code: container-runtime, mount-security, credential-proxy,
  Dockerfiles, and related config constants (~1,085 lines removed)
- Add codex instance launchd plist template

src/channels/discord.ts

@@ -250,9 +250,6 @@ export class DiscordChannel implements Channel {
     const group = this.opts.registeredGroups()[jid];
     if (!group) return false;
     const groupType = group.agentType || 'claude-code';
-    // 'both' channels are owned by the claude-code bot (primary handler for
-    // message storage and typing). The codex bot skips them to avoid duplicates.
-    if (groupType === 'both') return this.agentTypeFilter === 'claude-code';
     return groupType === this.agentTypeFilter;
   }