Add containerized agent execution with Apple Container

- Agents run in isolated Linux VMs via Apple Container
- All groups get Bash access (safe - sandboxed in container)
- Browser automation via agent-browser + Chromium
- Per-group configurable additional directory mounts
- File-based IPC for messages and scheduled tasks
- Container image with Node.js 22, Chromium, agent-browser

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/config.ts

@@ -6,5 +6,10 @@ export const GROUPS_DIR = './groups';
 export const DATA_DIR = './data';
 export const MAIN_GROUP_FOLDER = 'main';
 
+// Container configuration
+export const CONTAINER_IMAGE = process.env.CONTAINER_IMAGE || 'nanoclaw-agent:latest';
+export const CONTAINER_TIMEOUT = parseInt(process.env.CONTAINER_TIMEOUT || '300000', 10); // 5 minutes default
+export const IPC_POLL_INTERVAL = 1000; // Check IPC directories every second
+
 export const TRIGGER_PATTERN = new RegExp(`^@${ASSISTANT_NAME}\\b`, 'i');
 export const CLEAR_COMMAND = '/clear';