feat(phase-2): Theia container bridge via docker exec

- Dockerfile: install docker-ce-cli, run as root for socket access
- theia-exec.ts: container discovery (env > label > name), theiaExec(),
  syncToTheia() via docker cp
- agent-session-runner: execute_command → docker exec into Theia (fallback to local)
- agent-session-runner: syncToTheia() before auto-commit so "Open in Theia"
  shows agent files immediately after session completes
- server.ts: compute theiaWorkspaceSubdir from giteaRepo slug, log bridge status
  at startup
- custom_docker_run_options already set to mount /var/run/docker.sock

Made-with: Cursor

Dockerfile

@@ -1,10 +1,19 @@
 FROM node:20-slim
 
-# Install ripgrep (used by search_code tool) and git
+# Install ripgrep, git, and docker CLI (for docker exec into Theia container)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ripgrep \
     git \
     ca-certificates \
+    curl \
+    gnupg \
+    && install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
+    && chmod a+r /etc/apt/keyrings/docker.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
+       > /etc/apt/sources.list.d/docker.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends docker-ce-cli \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
@@ -22,12 +31,8 @@ RUN npm run build
 # Prune dev deps after build
 RUN npm prune --omit=dev
 
-# Create workspace dir and non-root user
-RUN useradd -r -m -s /bin/bash agent && \
-    mkdir -p /workspaces && \
-    chown -R agent:agent /workspaces /app
-
-USER agent
+# Create workspace dir
+RUN mkdir -p /workspaces
 
 # Git identity for commits made by agents
 RUN git config --global user.email "agent@vibnai.com" && \