fix: make rtk tracking DB writable inside the container

[ai-anant]

Problem

rtk fails to create its tracking DB inside the aidc container:

rtk: Failed to initialize tracking database: Failed to pre-create private DB file: /home/vscode/.local/share/rtk/history.db: Permission denied (os error 13)

rtk 0.44.2+ now propagates that open() error (it used to swallow it, so rtk gain just stayed at zero). Two aidc-specific causes produce the same EACCES:

1. ~/.local/share/rtk missing or not writable by vscode.
2. Claude Code's sandbox allowWrite list does not include that path (rtk-ai/rtk#320), so every sandboxed rtk call is denied.

A third bug made this sticky: install_agent_hooks wrote ~/.claude/.aidc-agent-hooks-installed even when rtk init failed, so later container starts never retried.

Fix

• Dockerfile: mkdir /home/vscode/.local/share/rtk as vscode with mode 0700 at image build.
• bootstrap-state.sh (every init):
  • Ensure the data dir exists, is owned by the container user, and is 0700 (sudo-chown if a root-owned leftover is in the way).
  • Idempotently add the path to sandbox.filesystem.allowWrite in in-container ~/.claude/settings.json (preserves existing entries; no-op on malformed/missing JSON).
  • Do not write the hook-installed marker when rtk init fails, so the next start retries.

Verification

• .github/scripts/test-bootstrap-state.sh — 16 passed, 0 failed (existing strip_host_hooks cases + 5 new ensure_rtk_sandbox_write cases).
• bash -n on the bootstrap template.
• .github/scripts/bash-compat-check.sh under bash 3.2.57 — OK.
• tests/resolve-oauth-token.test.sh — 7/7 pass.
• shellcheck --severity=warning on the test script — clean.
• semgrep --config auto on changed files — 0 findings.
• gitleaks detect — no leaks.
• python3 -m py_compile bin/aidc-clipboard-server — OK.

Fixes #31