chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

src/load-contracts.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Load the four immutable contract files in fixed order and write the
+# generated system prompt to /var/lib/mosaic/system-prompt.md.
+#
+# Order is normative: CONSTITUTION.md, STANDARDS.md, SOUL.md, USER.md.
+set -eu
+
+CONTRACT_DIR="${1:-/opt/mosaic/contracts}"
+OUT="${2:-/var/lib/mosaic/system-prompt.md}"
+
+FILES="CONSTITUTION.md STANDARDS.md SOUL.md USER.md"
+
+if [ ! -d "$CONTRACT_DIR" ]; then
+    echo "load-contracts: contract directory not found: $CONTRACT_DIR" >&2
+    exit 1
+fi
+
+PARENT="$(dirname "$OUT")"
+mkdir -p "$PARENT"
+
+TEMP="$OUT.partial"
+: > "$TEMP"
+
+for f in $FILES; do
+    path="$CONTRACT_DIR/$f"
+    if [ ! -r "$path" ]; then
+        echo "load-contracts: missing contract file: $path" >&2
+        rm -f "$TEMP"
+        exit 1
+    fi
+    printf '===== CONTRACT: %s =====\n' "$f" >> "$TEMP"
+    cat "$path" >> "$TEMP"
+    printf '\n' >> "$TEMP"
+done
+
+mv "$TEMP" "$OUT"
+echo "load-contracts: wrote $OUT from $CONTRACT_DIR" >&2

src/run-agent.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# One-shot Pi agent runner inside the container.
+# Loads the contract-generated system prompt, then sends exactly one
+# user request through Pi's documented noninteractive mode and prints
+# the model response on stdout.
+set -eu
+
+: "${PI_PROVIDER:=zai}"
+: "${PI_MODEL:=glm-5.3-flash}"
+export PI_PROVIDER PI_MODEL
+
+REQUEST="${*:-Return your startup marker and nothing else.}"
+
+/opt/mosaic/src/load-contracts.sh /opt/mosaic/contracts /var/lib/mosaic/system-prompt.md
+
+# All flags are documented in the package README (CLI Reference):
+#   -p / --print        noninteractive: print the response and exit
+#   --system-prompt     replace the default system prompt with the
+#                       contract-generated prompt
+#   --no-* switches     prevent ambient context files, skills, extensions,
+#                       prompt templates, and themes from being appended
+#   --no-session        ephemeral: no persistent agent session
+#   --no-tools          the startup request needs no tool execution
+#   --offline           disable startup network operations (update checks,
+#                       package update checks, install/update telemetry)
+exec pi \
+    --offline \
+    --no-session \
+    --no-extensions \
+    --no-skills \
+    --no-prompt-templates \
+    --no-themes \
+    --no-context-files \
+    --no-tools \
+    --provider "$PI_PROVIDER" \
+    --model "$PI_MODEL" \
+    --system-prompt "$(cat /var/lib/mosaic/system-prompt.md)" \
+    -p "$REQUEST"