chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

.gitignore

@@ -0,0 +1,8 @@
+# build/deps
+node_modules/
+
+# runtime credentials — never commit, never copy into the image
+.env
+secrets/
+
+# generated runtime state lives in /home/jwoltje/.mosaic-dev (outside this project)