fix: bypass DooD socat proxy so /afk agent turns stream

[lsfera]

Problem

Every /afk claude-tier iteration came back as an empty "Agent started → Agent stopped" turn with zero commits, regardless of issue, image, or claude-code version (2.1.181/193/195 all failed identically).

Root cause

The docker-outside-of-docker devcontainer feature fronts the host socket with a socat proxy (to fix permissions):

socat UNIX-LISTEN:/var/run/docker.sock,fork,... UNIX-CONNECT:/var/run/docker-host.sock

socat tears down docker exec's hijacked bidirectional stream after the first data burst. sandcastle streams the agent's stream-json over docker exec, so the agent's system/init line arrives, then everything after — the actual turn — is dropped. The exec close handler's exitCode: code ?? 0 masks the severed stream as a clean exit, so it surfaces as a silent empty turn.

Evidence

Test	Result
docker exec from the host	streams fully (claude completes)
Same from inside the devcontainer	only the init line, then dies
echo a; sleep 1; echo b; sleep 1; echo c via socat socket	only a
Same via docker-host.sock (bypass socat)	a b c

Fix

A guarded resolveDockerHost() called first thing in main() points the orchestrator's docker CLI at the real socket (docker-host.sock, which the feature also exposes and grants docker-group access to):

• No-op when socat isn't in play — a bare docker compose up (the cockpit distribution path) has no docker-host.sock; its raw /var/run/docker.sock streams natively and is left untouched. (A static docker-compose.yml env can't express this condition — the image has no entrypoint, so docker-host.sock only exists under the devcontainer lifecycle — which is why the fix lives in TypeScript, not compose.)
• No-op when DOCKER_HOST is already set — explicit choice wins.
• Pure decider with 4 unit tests; propagates to sandcastle's child docker processes via process.env.

Verification

With the fix live, two full autonomous /afk cycles implemented and merged real PRs (#69 cockpit Slice A, #70 Slice B) — commits=1 completed=true each. Suite: 131 pass, typecheck clean.

🤖 Generated with Claude Code