chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

scripts/verify.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Complete verification test:
+#   1. Build or confirm the image is built.
+#   2. Run the agent request.
+#   3. Remove surrounding whitespace from the response.
+#   4. Compare with the expected marker (default MOSAIC_HELLO_OK).
+#   5. Exit 0 only on exact match; nonzero otherwise.
+#
+# EXPECTED_MARKER may be overridden to prove the failure path
+# (acceptance criterion 9), e.g.:
+#   EXPECTED_MARKER=MOSAIC_NOT_OK scripts/verify.sh
+set -euo pipefail
+cd "$(dirname "$0")/.."
+# shellcheck source=common.sh
+source scripts/common.sh
+
+IMAGE="mosaic-poc-agent:0.84.4"
+EXPECTED="${EXPECTED_MARKER:-MOSAIC_HELLO_OK}"
+
+# 1. Build the image only if it is not already present.
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+    echo "verify: image $IMAGE not found, building..." >&2
+    bootstrap_runtime_dir
+    docker compose build
+fi
+
+# 2. Run the agent request (stdout only = model response).
+set +e
+RESPONSE="$(docker compose run --rm -T mosaic-agent 2>/tmp/mosaic-poc-stderr.$$)"
+RC=$?
+set -e
+STDERR_FILE="/tmp/mosaic-poc-stderr.$$"
+if [ $RC -ne 0 ]; then
+    echo "verify: agent run failed (exit $RC):" >&2
+    cat "$STDERR_FILE" >&2
+    rm -f "$STDERR_FILE"
+    exit 1
+fi
+rm -f "$STDERR_FILE"
+
+# 3. Remove surrounding whitespace.
+TRIMMED="$(printf '%s' "$RESPONSE" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+
+# 4-6. Exact comparison gate.
+if [ "$TRIMMED" = "$EXPECTED" ]; then
+    echo "PASS: response matches expected marker"
+    exit 0
+fi
+
+echo "FAIL: response does not match expected marker" >&2
+printf 'expected: %s\n' "$EXPECTED" >&2
+printf 'actual  : %s\n' "$TRIMMED" >&2
+exit 1