fix(docker): stop requiring the CLI on the host for a container session

Attaching a container, picking claude and hitting Run gave one line —
`execvp(3) failed.: No such file or directory` — and the run-mode menu offered
every mode. Three separate defects, found on a real deployment.

TmuxManager.createSession resolved the CLI directory without distinguishing a
docker session, so a host with no claude threw, the catch fell back to a direct
PTY, and that PTY exec'd the CLI on the HOST. The failure surfaced as a bare
execvp error naming nothing. A docker session runs its CLI inside the container;
the host does not need it. All eight modes now sit behind a cliRunsInContainer
guard, and whether the container has the CLI is settled by the adoption
preflight or the image gate before launch.

The running check used a bare double quote and command substitution. The whole
chain is embedded in an outer `bash -c "…"`, so the unescaped quote closed that
string early and the remainder was re-tokenized. It is now a `grep -qx` pipeline
using only the single-quote form every other line in the builder already uses.

Claude Code refuses --dangerously-skip-permissions as root. Our base image runs
a non-root user, so an owned container never hit this; an adopted container's
user belongs to its owner and is frequently root, and keeping the flag killed
the pane with a message visible only inside the container. The preflight now
reports runsAsRoot and the launch chain drops the flag for it.

The menu also showed every mode because the container CLI probe only started
when the menu opened. It is warmed when the case is selected instead.

test/docker-adopted-container.test.ts

@@ -12,6 +12,7 @@
 import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'node:fs';
 import {
+  defaultDockerCommandForMode,
   toSessionDocker,
   isAdoptedContainer,
   removeDockerContainer,
@@ -113,6 +114,18 @@ describe('adopted container: the launch chain never mutates lifecycle', () => {
     expect(adopted).toMatch(/not running.*never starts a container it does not own/i);
   });
 
+  it('uses no double quote and no command substitution in the launch chain', () => {
+    // The whole chain is embedded in an outer `bash -c "…"`. An unescaped `"`
+    // closes that string early, the remainder is re-tokenized, and tmux fails to
+    // exec with a bare `execvp(3) failed: No such file or directory` — no hint
+    // that the command was ever malformed. `$(…)` is banned with it because it
+    // is then evaluated by the wrong shell at the wrong time.
+    expect(adopted).not.toContain('"');
+    expect(adopted).not.toContain('$(');
+    // Every other line already quotes with the single-quote helper.
+    expect(adopted).toContain("grep -qx true");
+  });
+
   it('skips the base-image gate, which describes an image adoption never uses', () => {
     expect(owned).toContain('image inspect');
     expect(adopted).not.toContain('image inspect');
@@ -129,6 +142,43 @@ describe('adopted container: the launch chain never mutates lifecycle', () => {
   });
 });
 
+describe('adopted container: claude as root', () => {
+  it('drops --dangerously-skip-permissions when the container runs as root', () => {
+    // Claude Code refuses the flag as root ("cannot be used with root/sudo
+    // privileges"), so keeping it kills the pane with a message only visible
+    // inside the container. Our base image runs a non-root user, which is why an
+    // owned container never hit this.
+    expect(defaultDockerCommandForMode('claude', true)).toBe('exec claude');
+    expect(defaultDockerCommandForMode('claude', false)).toContain('--dangerously-skip-permissions');
+    expect(defaultDockerCommandForMode('claude')).toContain('--dangerously-skip-permissions');
+  });
+
+  it('leaves every other mode unchanged as root', () => {
+    for (const mode of ['codex', 'shell', 'pi'] as const) {
+      expect(defaultDockerCommandForMode(mode, true)).toBe(defaultDockerCommandForMode(mode, false));
+    }
+  });
+});
+
+describe('adopted container: the host is not required to have the CLI', () => {
+  const src = readFileSync(new URL('../src/tmux-manager.ts', import.meta.url), 'utf8');
+
+  it('skips every host CLI requirement for a docker session', () => {
+    // A docker session runs its CLI inside the container. Demanding it on the
+    // host threw, the catch fell back to a direct PTY, and that PTY tried to
+    // exec the CLI on the HOST — surfacing as a bare `execvp(3) failed` with
+    // nothing naming the real cause.
+    const guarded = src.match(/!cliRunsInContainer && mode === '/g) || [];
+    const unguarded = src.match(/\n    if \(mode === '[a-z]+' && !cliDir\)/g) || [];
+    expect(guarded.length).toBeGreaterThanOrEqual(7);
+    expect(unguarded).toHaveLength(0);
+  });
+
+  it('derives the flag from the docker metadata the session already carries', () => {
+    expect(src).toContain('const cliRunsInContainer = !!docker;');
+  });
+});
+
 describe('adopted container: mutating verbs fail closed at the builder', () => {
   const docker = toSessionDocker(HOST, caseFor(false));
 
@@ -202,7 +252,7 @@ describe('adopted container: run modes come from the CONTAINER, not the host', (
   const refreshFn = (src) => {
     const start = src.indexOf('_refreshRunModeAvailability(menu) {');
     expect(start).toBeGreaterThan(-1);
-    return src.slice(start, start + 1600);
+    return src.slice(start, start + 2000);
   };
 
   it('gates a docker case on availableModes instead of host CLI probes', () => {