refactor: remove container references from setup, use host process runners

- setup/container.ts: replace container build with npm run build:runners
- setup/index.ts: rename step container → runners
- setup/environment.ts: remove Docker/Apple Container detection
- setup/service.ts: remove Docker group stale check, add nodeBin and
  npm-global to service PATH for codex CLI
- setup/verify.ts: remove container runtime check
- SKILL.md: rewrite for container-free setup, add Codex auth step

setup/container.ts

@@ -1,141 +1,55 @@
 /**
- * Step: container — Build container image and verify with test run.
- * Replaces 03-setup-container.sh
+ * Step: runners — Build agent runners (no container needed).
+ * Agents run as direct host processes.
  */
 import { execSync } from 'child_process';
+import fs from 'fs';
 import path from 'path';
 
 import { logger } from '../src/logger.js';
-import { commandExists } from './platform.js';
 import { emitStatus } from './status.js';
 
-function parseArgs(args: string[]): { runtime: string } {
-  let runtime = '';
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === '--runtime' && args[i + 1]) {
-      runtime = args[i + 1];
-      i++;
-    }
-  }
-  return { runtime };
-}
-
-export async function run(args: string[]): Promise<void> {
+export async function run(_args: string[]): Promise<void> {
   const projectRoot = process.cwd();
-  const { runtime } = parseArgs(args);
-  const image = 'nanoclaw-agent:latest';
-  const logFile = path.join(projectRoot, 'logs', 'setup.log');
 
-  if (!runtime) {
-    emitStatus('SETUP_CONTAINER', {
-      RUNTIME: 'unknown',
-      IMAGE: image,
-      BUILD_OK: false,
-      TEST_OK: false,
-      STATUS: 'failed',
-      ERROR: 'missing_runtime_flag',
-      LOG: 'logs/setup.log',
-    });
-    process.exit(4);
-  }
-
-  // Validate runtime availability
-  if (runtime === 'apple-container' && !commandExists('container')) {
-    emitStatus('SETUP_CONTAINER', {
-      RUNTIME: runtime,
-      IMAGE: image,
-      BUILD_OK: false,
-      TEST_OK: false,
-      STATUS: 'failed',
-      ERROR: 'runtime_not_available',
-      LOG: 'logs/setup.log',
-    });
-    process.exit(2);
-  }
-
-  if (runtime === 'docker') {
-    if (!commandExists('docker')) {
-      emitStatus('SETUP_CONTAINER', {
-        RUNTIME: runtime,
-        IMAGE: image,
-        BUILD_OK: false,
-        TEST_OK: false,
-        STATUS: 'failed',
-        ERROR: 'runtime_not_available',
-        LOG: 'logs/setup.log',
-      });
-      process.exit(2);
-    }
-    try {
-      execSync('docker info', { stdio: 'ignore' });
-    } catch {
-      emitStatus('SETUP_CONTAINER', {
-        RUNTIME: runtime,
-        IMAGE: image,
-        BUILD_OK: false,
-        TEST_OK: false,
-        STATUS: 'failed',
-        ERROR: 'runtime_not_available',
-        LOG: 'logs/setup.log',
-      });
-      process.exit(2);
-    }
-  }
-
-  if (!['apple-container', 'docker'].includes(runtime)) {
-    emitStatus('SETUP_CONTAINER', {
-      RUNTIME: runtime,
-      IMAGE: image,
-      BUILD_OK: false,
-      TEST_OK: false,
-      STATUS: 'failed',
-      ERROR: 'unknown_runtime',
-      LOG: 'logs/setup.log',
-    });
-    process.exit(4);
-  }
-
-  const buildCmd =
-    runtime === 'apple-container' ? 'container build' : 'docker build';
-  const runCmd = runtime === 'apple-container' ? 'container' : 'docker';
-
-  // Build
+  // Build agent runners
   let buildOk = false;
-  logger.info({ runtime }, 'Building container');
+  logger.info('Building agent runners');
   try {
-    execSync(`${buildCmd} -t ${image} .`, {
-      cwd: path.join(projectRoot, 'container'),
+    execSync('npm run build:runners', {
+      cwd: projectRoot,
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     buildOk = true;
-    logger.info('Container build succeeded');
+    logger.info('Agent runners build succeeded');
   } catch (err) {
-    logger.error({ err }, 'Container build failed');
+    logger.error({ err }, 'Agent runners build failed');
   }
 
-  // Test
-  let testOk = false;
-  if (buildOk) {
-    logger.info('Testing container');
-    try {
-      const output = execSync(
-        `echo '{}' | ${runCmd} run -i --rm --entrypoint /bin/echo ${image} "Container OK"`,
-        { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] },
-      );
-      testOk = output.includes('Container OK');
-      logger.info({ testOk }, 'Container test result');
-    } catch {
-      logger.error('Container test failed');
-    }
-  }
+  // Verify runner entry points exist
+  const agentRunner = path.join(
+    projectRoot,
+    'container',
+    'agent-runner',
+    'dist',
+    'index.js',
+  );
+  const codexRunner = path.join(
+    projectRoot,
+    'container',
+    'codex-runner',
+    'dist',
+    'index.js',
+  );
+  const agentRunnerOk = fs.existsSync(agentRunner);
+  const codexRunnerOk = fs.existsSync(codexRunner);
 
-  const status = buildOk && testOk ? 'success' : 'failed';
+  const status = buildOk && agentRunnerOk ? 'success' : 'failed';
 
-  emitStatus('SETUP_CONTAINER', {
-    RUNTIME: runtime,
-    IMAGE: image,
+  emitStatus('SETUP_RUNNERS', {
     BUILD_OK: buildOk,
-    TEST_OK: testOk,
+    AGENT_RUNNER: agentRunnerOk,
+    CODEX_RUNNER: codexRunnerOk,
     STATUS: status,
     LOG: 'logs/setup.log',
   });