chore: baseline container POC and atomic foundation plan

- Containerized Pi hello-world proof (image mosaic-poc-agent:0.84.4, non-root)
- Four immutable contract fixtures loaded into a generated system prompt
- build/hello/verify/reset scripts with exact-match gating and reset safety
- Documented Pi discovery (v0.84.4, -p mode, --system-prompt, container auth)
- Append-only BUILD-LOG with corrections; deferred layers in LAYERS.md
- Architecture plan: docs/plans/2026-09-02_atomic-mosaic-foundation.md

src/run-agent.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+# One-shot Pi agent runner inside the container.
+# Loads the contract-generated system prompt, then sends exactly one
+# user request through Pi's documented noninteractive mode and prints
+# the model response on stdout.
+set -eu
+
+: "${PI_PROVIDER:=zai}"
+: "${PI_MODEL:=glm-5.3-flash}"
+export PI_PROVIDER PI_MODEL
+
+REQUEST="${*:-Return your startup marker and nothing else.}"
+
+/opt/mosaic/src/load-contracts.sh /opt/mosaic/contracts /var/lib/mosaic/system-prompt.md
+
+# All flags are documented in the package README (CLI Reference):
+#   -p / --print        noninteractive: print the response and exit
+#   --system-prompt     replace the default system prompt with the
+#                       contract-generated prompt
+#   --no-* switches     prevent ambient context files, skills, extensions,
+#                       prompt templates, and themes from being appended
+#   --no-session        ephemeral: no persistent agent session
+#   --no-tools          the startup request needs no tool execution
+#   --offline           disable startup network operations (update checks,
+#                       package update checks, install/update telemetry)
+exec pi \
+    --offline \
+    --no-session \
+    --no-extensions \
+    --no-skills \
+    --no-prompt-templates \
+    --no-themes \
+    --no-context-files \
+    --no-tools \
+    --provider "$PI_PROVIDER" \
+    --model "$PI_MODEL" \
+    --system-prompt "$(cat /var/lib/mosaic/system-prompt.md)" \
+    -p "$REQUEST"