feat(docker): Phase 4 reproducible experiment VM (4.1+4.2+4.3)

[nextlevelshit]

Summary

Phase 4 of Epic #1565 — Dockerized Wave experiment VM that boots against any Codeberg/Gitea target repo, runs onboard-project on first contact, and serves the webui on :8080. End-to-end smoke (4.4) lands as a follow-up once a real Codeberg target + Anthropic key are wired.

What lands

• 4.1 `docker/Dockerfile.experiment` — multi-stage build:
  • Stage 1: `golang:1.22-bookworm` builds wave with `-tags=webui_preview`
  • Stage 2: `debian:bookworm-slim` fetches `tea` v0.11.1 binary
  • Stage 3: `node:22-bookworm-slim` runtime with `@anthropic-ai/claude-code` via npm + `git`, `gh`, `curl`, `jq`, `sqlite3`, `tini`
  • Drops to non-root `wave` user, EXPOSE 8080, tini PID 1.
• 4.2 `docker/entrypoint.sh` — bash (`#!/usr/bin/env bash`, deliberately no `set -o pipefail` after the dash-incompat hit on feat(pipelines): add pipeline-evolve meta-pipeline #1611). Idempotent: clone via tea/git, `wave init`, `wave run onboard-project` if no sentinel, then `exec wave serve`. Restarts reuse the clone.
• 4.3 `docker/docker-compose.experiment.yml` + `docker/.env.experiment.example` — single service, two named volumes:
  • `wave-work` → `/work` (clone + state.db survives rebuilds)
  • `wave-config` → `/home/wave/.config` (claude OAuth + tea login persist)
  • healthcheck hits `/health`, restart=unless-stopped.
  • `.env.experiment` is gitignored; the example file is the template.

Test plan

• `bash -n docker/entrypoint.sh` — syntax clean
• `docker compose -f docker/docker-compose.experiment.yml --env-file docker/.env.experiment build` — build succeeds
• First boot against a fresh Codeberg target — clones, onboards, sentinel written, webui reachable on :8080
• Restart container — entrypoint short-circuits clone + init + onboard, just boots
• 4.4 End-to-end smoke against `code-crispies` (the canonical walkthrough target). Tracked separately.

Why no `set -o pipefail` in entrypoint

#1611 shipped `set -o pipefail` in pipeline-evolve.yaml scripts; CI's `sh` (dash) doesn't support it and tests failed. Lesson banked: bash-shebang makes pipefail safe to add later, but the entrypoint here doesn't pipe-chain anywhere it matters, so I'm leaving it off rather than adding a safety I don't need.

Related

• Epic Epic: Onboarding-as-Session — work-source-centric webui + self-evolving pipelines #1565 Phase 4
• Memory `feedback_metroidvania_loop` — pipefail bug from feat(pipelines): add pipeline-evolve meta-pipeline #1611 informed this entrypoint design.
• Memory `feedback_real_verification` — 4.4 smoke is the actual gate; this PR is just the scaffolding.