compose: add wrapper-first dogfood workspace (#1487)

docker-compose.dogfood.yml

@@ -0,0 +1,22 @@
+# Explicit, single-seat dogfood mode for stack-containerization B2.
+# Use with docker-compose.yml. The base stack remains credential-free.
+services:
+  gateway:
+    environment:
+      # Identity and credential layout match a fleet seat. This fixed name prevents
+      # an operator from mounting one seat while attributing actions to another.
+      MOSAIC_AGENT_NAME: stack-dogfood
+      MOSAIC_GIT_IDENTITY: stack-dogfood
+      MOSAIC_BRAIN_HOME: /opt/mosaic/brain
+      AGENT_FILE_SANDBOX_DIR: /workspace/stack
+      AGENT_USER_TOOLS: fs_read_file,fs_write_file,fs_list_directory,fs_edit_file,git_status,git_log,git_diff,shell_exec
+    volumes:
+      # Mount a dedicated worktree, never the canonical clone or divergent local main.
+      - type: bind
+        source: ${MOSAIC_DOGFOOD_WORKTREE:?set to a dedicated next-based stack worktree}
+        target: /workspace/stack
+      # Only this seat home enters the container. Other fleet credentials stay outside.
+      - type: bind
+        source: ${MOSAIC_DOGFOOD_SEAT_HOME:?set to the external stack-dogfood seat directory}
+        target: /opt/mosaic/brain/fleet/agents/stack-dogfood
+        read_only: true