feat(pods): Claude Code + Codex in member pods (custom image)

Members can now code in their pod: build a custom pod image (FROM the base
Ubuntu) that ships git, openssh-client, Node.js 22, and the Claude Code
(`claude`) and Codex (`codex`) CLIs. BYO key — no credentials are baked in; a
member exports their own ANTHROPIC_API_KEY / OPENAI_API_KEY (or uses the tools'
login flow), stored in their persisted home.

- pods/Containerfile: the image (also drops a BYO-key + git-push login hint).
- setup.sh: build it on the host (rootless podman, layer-cached), switch
  AGENTBBS_POD_IMAGE to localhost/agentbbs-pod:latest (upserted for existing
  installs), keeping the base image if the build fails.
- pods.go: image-aware self-heal — an idle pod on an out-of-date image is
  recreated (home volume kept) so the new tooling rolls out without a manual
  rebuild and without disturbing active sessions.

Verified: image builds on the host; inside it node v22, git, ssh, `claude
--version` (2.1.186) and `codex --version` (0.142.0) all run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -216,6 +216,21 @@ fi
 sudo -u "$SVC_USER" XDG_RUNTIME_DIR="/run/user/$SVC_UID" \
   podman pull -q "$POD_IMAGE" >/dev/null 2>&1 || warn "could not pre-pull $POD_IMAGE (pods will pull on first use)"
 
+# Build the member pod image (FROM $POD_IMAGE): adds git, openssh-client, Node,
+# and the Claude Code + Codex CLIs so members can code in their pod (BYO API
+# key). podman layer-caches, so an unchanged Containerfile rebuilds cheaply. On
+# failure we keep the base image rather than break pod launches.
+if [ -f "$SRC_DIR/pods/Containerfile" ]; then
+  log "building member pod image (localhost/agentbbs-pod:latest)"
+  if sudo -u "$SVC_USER" XDG_RUNTIME_DIR="/run/user/$SVC_UID" \
+       podman build -t localhost/agentbbs-pod:latest \
+       -f "$SRC_DIR/pods/Containerfile" "$SRC_DIR/pods" >/dev/null 2>&1; then
+    POD_IMAGE="localhost/agentbbs-pod:latest"
+  else
+    warn "pod image build failed — keeping $POD_IMAGE (run: podman build -f $SRC_DIR/pods/Containerfile $SRC_DIR/pods)"
+  fi
+fi
+
 # ---- 6. environment file ---------------------------------------------------
 ENV_DIR=/etc/agentbbs
 install -d -m 0750 "$ENV_DIR"
@@ -332,6 +347,9 @@ upsert_env() {  # KEY VALUE — skips when VALUE is empty
   chmod 0640 "$file"
 }
 # CoinPay: API key (read by the coinpay CLI) + merchant/business id.
+# Point existing installs at the freshly built member pod image (fresh installs
+# get it from the env-file template below).
+upsert_env AGENTBBS_POD_IMAGE "$POD_IMAGE"
 upsert_env COINPAY_API_KEY "${COINPAY_API_KEY:-}"
 upsert_env AGENTBBS_COINPAY_MERCHANT_ID "${COINPAY_MERCHANT_ID:-${AGENTBBS_COINPAY_MERCHANT_ID:-}}"
 upsert_env COINPAY_BUSINESS_ID "${COINPAY_MERCHANT_ID:-${AGENTBBS_COINPAY_MERCHANT_ID:-}}"