chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

scripts/reset.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Delete the generated POC runtime state at /home/jwoltje/.mosaic-dev,
+# but ONLY when every safety check passes:
+#   1. The resolved path is exactly /home/jwoltje/.mosaic-dev.
+#   2. The path is not a symbolic link.
+#   3. The directory contains the .mosaic-poc-root ownership marker
+#      created by this project.
+# Any failed check aborts with nothing deleted.
+set -euo pipefail
+
+TARGET="/home/jwoltje/.mosaic-dev"
+MARKER=".mosaic-poc-root"
+
+fail() {
+    echo "reset: refusing to delete: $*" >&2
+    exit 1
+}
+
+# Nothing to do when the directory does not exist.
+if [ ! -e "$TARGET" ]; then
+    echo "reset: $TARGET does not exist; nothing to remove"
+    exit 0
+fi
+
+# Check 2 (before resolution): the path itself must not be a symlink.
+if [ -L "$TARGET" ]; then
+    fail "$TARGET is a symbolic link"
+fi
+
+# Check 1: resolved path must be exactly the POC runtime directory.
+RESOLVED="$(realpath "$TARGET")"
+if [ "$RESOLVED" != "$TARGET" ]; then
+    fail "resolved path $RESOLVED is not $TARGET"
+fi
+
+# Check 3: ownership marker created by this project must be present.
+if [ ! -f "$TARGET/$MARKER" ]; then
+    fail "missing $MARKER ownership marker in $TARGET"
+fi
+
+rm -rf -- "$TARGET"
+echo "reset: removed $TARGET"