refactor: dual-instance setup, remove dead container code

- Make STORE_DIR, DATA_DIR, GROUPS_DIR configurable via env vars
  (NANOCLAW_STORE_DIR, NANOCLAW_DATA_DIR, NANOCLAW_GROUPS_DIR)
  for running two instances from one codebase
- Remove broken 'both' agent type sequential loop from processGroupMessages
- Delete dead code: container-runtime, mount-security, credential-proxy,
  Dockerfiles, and related config constants (~1,085 lines removed)
- Add codex instance launchd plist template

src/container-runner.ts

@@ -140,9 +140,10 @@ function prepareGroupEnvironment(
   const extraPaths = [nodeBin, npmGlobalBin].filter(
     (p) => !currentPath.includes(p) && fs.existsSync(p),
   );
-  const enrichedPath = extraPaths.length > 0
-    ? `${extraPaths.join(':')}:${currentPath}`
-    : currentPath;
+  const enrichedPath =
+    extraPaths.length > 0
+      ? `${extraPaths.join(':')}:${currentPath}`
+      : currentPath;
 
   const env: Record<string, string> = {
     ...cleanEnv,