clean out the per-container architecture's remnants

The first iteration gave every user their own Docker container: the user's whole
world lived inside it, and only the super admin could see the real filesystem.
That model is gone, but its scaffolding was still in the tree, and it had already
cost time today — the /usr/local/bin/claude symlink removed a few commits ago
existed only because the bwrap jail ro-bound /usr and could not see the
installer's target.

Deleted:
  generate-container-context.ts   built the CLAUDE.md and settings.json that told
                                  an agent what its container looked like. Its
                                  only importer was the provisioning removed in
                                  the previous commit, so it had zero consumers.
  getUserPiConfigDir              pointed into the managed container home. No
                                  consumers anywhere in the tree.

Renamed:
  DATA_PATH/<email>/.container-context -> agent-config. It holds one file, the
  MCP server config handed to the CLI, and has nothing to do with containers. The
  path is written and consumed through a return value, so nothing else reads it;
  an old directory left on disk is inert.

Documented rather than removed, because both still have live callers and pulling
them out is a refactor rather than a cleanup:
  getHomeDir        the container's home. Nothing executes there now — terminals,
                    chats and task runs all use getOwnerHomeDir — but it survives
                    as that function's fallback and in pipeline-executor.
  toShellUsername   named for deriving a Linux username inside the container,
                    32-char limit and all. Nothing creates a Linux user now; the
                    value ends up only as a claim in the signed task token, so it
                    is a sanitiser wearing an old name. Unpicking it means
                    changing that token and WSData.

Nothing to clean on disk: DATA_PATH/<email> has no home/ tree and no
.container-context/. The docs that still mention any of this are the two marked
"Historical" at the top, which are records of what was true then and should keep
saying so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/sidecar/claude/user-instance.ts

@@ -68,7 +68,12 @@ loadState();
 // ── MCP config ──
 
 function generateMcpConfig(): string {
-  const contextDir = join(DATA_PATH, email!, '.container-context');
+  // Was `.container-context`, from the architecture where each user ran inside their own Docker
+  // container and this directory described that container to the agent. Nothing about it is
+  // container-related now — it holds exactly one file, the MCP server config handed to the CLI. The
+  // path is written here and consumed through the return value, so nothing else reads it and the
+  // rename costs nothing; an old `.container-context` directory left on disk is inert.
+  const contextDir = join(DATA_PATH, email!, 'agent-config');
   mkdirSync(contextDir, { recursive: true });
 
   const userRoot = join(DATA_PATH, email!);