feat: add canonical agent training and declarative container preparation

[apresmoi]

This branch adds spawnfile train for one canonical agent through Paideia, with a supervised single-container runtime, explicit readonly inputs/auth leaves, verified completion, and resume forwarding.

The latest commit starts training-config v2 so that image preparation can run behind the same command: a packaged pinned Daimon/DSPy recipe, declared package distributions, relative mounts, Git snapshots with hash-checked overlays, image reuse, and a mapped integration receipt. The existing v1 image/config path remains available.

Status

Draft checkpoint requested by the operator. The branch includes earlier training implementation commits as well as the unfinished v2 preparation work; it is not ready to merge.

• Latest targeted preparation suite: 7 tests passed, including real Git snapshot/overlay and tampering checks.
• TypeScript passed before the final v2 edits; no final typecheck has run.
• Remaining: public CLI cold/warm/resume integration, installed-package recipe verification, 90% coverage, full relevant checks, documentation, isolated image build smoke, and independent review.
• No running training container was rebuilt or stopped by this change.

Verification was explicitly stopped at the operator’s request to publish this checkpoint promptly.