refactor: remove container references from setup, use host process runners

- setup/container.ts: replace container build with npm run build:runners
- setup/index.ts: rename step container → runners
- setup/environment.ts: remove Docker/Apple Container detection
- setup/service.ts: remove Docker group stale check, add nodeBin and
  npm-global to service PATH for codex CLI
- setup/verify.ts: remove container runtime check
- SKILL.md: rewrite for container-free setup, add Codex auth step

setup/service.ts

@@ -101,7 +101,7 @@ function setupLaunchd(
     <key>EnvironmentVariables</key>
     <dict>
         <key>PATH</key>
-        <string>/usr/local/bin:/usr/bin:/bin:${homeDir}/.local/bin</string>
+        <string>${path.dirname(nodePath)}:/usr/local/bin:/usr/bin:/bin:${homeDir}/.local/bin:${homeDir}/.npm-global/bin</string>
         <key>HOME</key>
         <string>${homeDir}</string>
     </dict>
@@ -174,33 +174,6 @@ function killOrphanedProcesses(projectRoot: string): void {
   }
 }
 
-/**
- * Detect stale docker group membership in the user systemd session.
- *
- * When a user is added to the docker group mid-session, the user systemd
- * daemon (user@UID.service) keeps the old group list from login time.
- * Docker works in the terminal but not in the service context.
- *
- * Only relevant on Linux with user-level systemd (not root, not macOS, not WSL nohup).
- */
-function checkDockerGroupStale(): boolean {
-  try {
-    execSync('systemd-run --user --pipe --wait docker info', {
-      stdio: 'pipe',
-      timeout: 10000,
-    });
-    return false; // Docker works from systemd session
-  } catch {
-    // Check if docker works from the current shell (to distinguish stale group vs broken docker)
-    try {
-      execSync('docker info', { stdio: 'pipe', timeout: 5000 });
-      return true; // Works in shell but not systemd session → stale group
-    } catch {
-      return false; // Docker itself is not working, different issue
-    }
-  }
-}
-
 function setupSystemd(
   projectRoot: string,
   nodePath: string,
@@ -244,7 +217,7 @@ WorkingDirectory=${projectRoot}
 Restart=always
 RestartSec=5
 Environment=HOME=${homeDir}
-Environment=PATH=/usr/local/bin:/usr/bin:/bin:${homeDir}/.local/bin
+Environment=PATH=${path.dirname(nodePath)}:/usr/local/bin:/usr/bin:/bin:${homeDir}/.local/bin:${homeDir}/.npm-global/bin
 StandardOutput=append:${projectRoot}/logs/nanoclaw.log
 StandardError=append:${projectRoot}/logs/nanoclaw.error.log
 
@@ -254,14 +227,6 @@ WantedBy=${runningAsRoot ? 'multi-user.target' : 'default.target'}`;
   fs.writeFileSync(unitPath, unit);
   logger.info({ unitPath }, 'Wrote systemd unit');
 
-  // Detect stale docker group before starting (user systemd only)
-  const dockerGroupStale = !runningAsRoot && checkDockerGroupStale();
-  if (dockerGroupStale) {
-    logger.warn(
-      'Docker group not active in systemd session — user was likely added to docker group mid-session',
-    );
-  }
-
   // Kill orphaned nanoclaw processes to avoid channel connection conflicts
   killOrphanedProcesses(projectRoot);
 
@@ -299,7 +264,6 @@ WantedBy=${runningAsRoot ? 'multi-user.target' : 'default.target'}`;
     PROJECT_PATH: projectRoot,
     UNIT_PATH: unitPath,
     SERVICE_LOADED: serviceLoaded,
-    ...(dockerGroupStale ? { DOCKER_GROUP_STALE: true } : {}),
     STATUS: 'success',
     LOG: 'logs/setup.log',
   });