chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

compose.yaml

@@ -0,0 +1,25 @@
+services:
+  mosaic-agent:
+    build:
+      context: .
+      dockerfile: Containerfile
+    image: mosaic-poc-agent:0.84.4
+    user: "1000:1000"
+    environment:
+      # Non-secret settings (see .env.example)
+      PI_PROVIDER: ${PI_PROVIDER:-zai}
+      PI_MODEL: ${PI_MODEL:-glm-5.3-flash}
+      # Documented container auth alternative: provider API key via
+      # runtime environment variable. Empty by default; when empty Pi
+      # falls back to the read-only mounted auth.json credential file.
+      ZAI_API_KEY: ${ZAI_API_KEY:-}
+      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
+    volumes:
+      # Generated runtime state (host dir per brief)
+      - /home/jwoltje/.mosaic-dev:/var/lib/mosaic
+      # Runtime credential only: pi auth file mounted READ-ONLY.
+      # Never copied into the image.
+      - ${PI_AUTH_FILE:-/home/jwoltje/.pi/agent/auth.json}:/home/node/.pi/agent/auth.json:ro
+    # One-shot: the exact startup verification request. It deliberately
+    # does NOT contain the expected marker MOSAIC_HELLO_OK.
+    command: ["Return your startup marker and nothing else."]