chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

scripts/hello.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Run the mosaic-agent service as a one-shot container and print the
+# model response for the exact startup verification request.
+#
+# The request deliberately does NOT contain the expected marker
+# MOSAIC_HELLO_OK. Only the model response is printed to stdout; no
+# credentials or unrelated runtime data are printed.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+# shellcheck source=common.sh
+source scripts/common.sh
+
+bootstrap_runtime_dir
+
+# -T: no pseudo-TTY, so stdout is clean model output.
+# Errors, if any, go to stderr for diagnostics.
+docker compose run --rm -T mosaic-agent