fix(launcher): ensure configured data root before verify mount; docs for M1 (#4)

- verify.sh now calls bootstrap_runtime_dir after load_config; previously a
  reset-then-verify flow let Docker auto-create a root-owned mount source
- common.sh: fail with clear guidance when data root exists but is not writable
- README: configuration section, bootstrap usage, selftest entry point
- BUILD-LOG: Phase 5 entries with corrections

E2E (clean slate): 20/20 selftests; bootstrap idempotent; config-driven
hello/verify MOSAIC_HELLO_OK; negative marker exit 1; reset + rerun green;
config checksum unchanged across the entire flow.

Closes #4

scripts/common.sh

@@ -23,7 +23,14 @@ load_config() {
 # project's ownership marker. The marker is what scripts/reset.sh requires
 # before it will delete anything.
 bootstrap_runtime_dir() {
-    if [ ! -d "$MOSAIC_DEV_DIR" ]; then
+    if [ -d "$MOSAIC_DEV_DIR" ]; then
+        if [ ! -w "$MOSAIC_DEV_DIR" ] || [ ! -x "$MOSAIC_DEV_DIR" ]; then
+            echo "bootstrap: $MOSAIC_DEV_DIR exists but is not writable by $(id -un)" >&2
+            echo "bootstrap: a root-owned directory here is usually leftover from a" >&2
+            echo "bootstrap: Docker-created mount source; remove it and rerun." >&2
+            exit 1
+        fi
+    else
         mkdir -p "$MOSAIC_DEV_DIR"
         echo "bootstrap: created $MOSAIC_DEV_DIR"
     fi

scripts/verify.sh

@@ -19,6 +19,10 @@ EXPECTED="${EXPECTED_MARKER:-MOSAIC_HELLO_OK}"
 
 load_config
 
+# Ensure the configured data root exists (host-owned) before the mount,
+# otherwise Docker would auto-create a root-owned directory.
+bootstrap_runtime_dir
+
 # 1. Build the image only if it is not already present.
 if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
     echo "verify: image $IMAGE not found, building..." >&2