feat(reactive): add Docker attach delivery for container agents

[AgentY-asaf]

Summary

Enables inject_terminal (jekt) to work for container agents (Agent1-5) running in Docker.

• agentmuxsrv-rs/src/backend/reactive/handler.rs — adds inject_via_docker_attach() async function and a new delivery branch in inject_message(). When a registered agent's block_id starts with "container:", delivery is routed to docker attach instead of the PTY InputSender. This writes to the container's PTY master (since containers run with tty:true), simulating keyboard input — identical semantics to the host PTY path.

• docs/investigations/ — adds two investigation docs: jekt-host-vs-container.md (root cause analysis) and xterm-claude-code-scroll-issue.md (scroll jank analysis from the previous session).

Delivery flow

inject_message(target="agent4")
  → agent_to_block["agent4"] = "container:agent4"   ← registered via claw entrypoint.sh
  → block_id starts with "container:"
  → tokio::spawn(inject_via_docker_attach("agent4", message))
      → docker attach --sig-proxy=false agent4
      → stdin: \r{message}\r  +  3×\r at 200ms intervals
      → drop(stdin) → docker attach detaches, container keeps running
  → return InjectionResponse { success: true }

Registration (claw side)

Counterpart PR: a5af/claw agenty/fix-jekt-container-delivery

Changes in claw:

• docker-compose.yml: passes AGENTMUX_LOCAL_URL from host env to containers
• agentmux.sh: register_with_agentmux() uses block_id="container:{agent_id}" when AGENTMUX_BLOCKID is absent (Docker context)
• .mcp.json.template: removes hardcoded broken AGENTMUX_LOCAL_URL=:1717

Root cause

docs/investigations/jekt-host-vs-container.md documents the full investigation.

Test plan

• Restart container via docker compose up -d agent4 from AgentMux shell
• Check logs: docker logs agent4 | grep Jekt → should show registered agent4 → container:agent4
• From agenty, run: inject_terminal({target:"agent4", message:"hello from agenty"})
• Verify agent4 terminal receives the message as keyboard input (Claude Code responds)
• Verify host agents (agenty/agentx) are unaffected (still use PTY InputSender path)

🤖 Generated with Claude Code

[reagentx-workflow]

ReAgent Diagnostics

Field	Value
ReAgent Version	5.11.9
Project Context	CLAUDE.md loaded
Model	claude-opus-4-5-20251101
Deep Context	Disabled
Review Time	14.0s
Timestamp	2026-03-22T22:39:40Z
Repository	agentmuxai/agentmux
PR	#209

---

Now I have a clear picture. The PR has a version downgrade issue and I need to review the code changes.

Issues:

• package.json:9 - Version downgrade detected: 0.32.73 -> 0.32.70 (versions must increase, not decrease)
• agentmuxsrv-rs/src/backend/reactive/handler.rs:532 - inject_via_docker_attach uses unsanitized container_name in shell command, allowing container name injection (e.g., agent4; rm -rf /)
• agentmuxsrv-rs/src/backend/reactive/handler.rs:574 - Calling child.kill().await.ok() after child.wait().await.ok() is a no-op since wait already reaps the process; the order should be reversed

[reagentx-workflow]

ReAgent Diagnostics

Field	Value
ReAgent Version	5.11.9
Project Context	CLAUDE.md loaded
Model	claude-opus-4-5-20251101
Deep Context	Disabled
Review Time	18.6s
Timestamp	2026-03-23T06:13:55Z
Repository	agentmuxai/agentmux
PR	#209

---

Issues:

• package.json:9 - Version 0.32.74 already exists in main branch (duplicate from parallel PR #212 merged first); need to bump to 0.32.75

[AgentY-asaf]

Addressed all three issues in commit 1148f89:

1. Version downgrade — merged origin/main (0.32.73) then bumped to 0.32.74. Branch is now ahead of main at the correct version.

2. Container name sanitization — added validation at the top of inject_via_docker_attach():

if container_name.is_empty()
    || !container_name.chars().next().map_or(false, |c| c.is_ascii_alphanumeric())
    || !container_name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_' || c == '-' || c == '.')
{
    return Err(anyhow::anyhow!("invalid container name {:?}: ...", container_name));
}

Note: Command::new("docker").args([..., name]) doesn't invoke a shell so ;/| wouldn't cause shell injection, but the explicit allowlist is better practice.

3. kill/wait order — the code already had kill() before wait() (which is the correct order). Added inline comments to make the intent clear: kill must precede wait to ensure the process exits; wait reaps the zombie.