feat(docker): add agent docker shell and persist global npm/pip installs in agent home

[radim10]

Add stashbase agent docker shell, an interactive admin shell in the
sandbox image with the shared persistent home volume (/home/agent)
mounted — for logging in, editing config, and installing tools without
routing arbitrary commands through agent run --profile.

• No profile needed: uses the default sandbox image (--image to
  override) and none of a run's sandboxing (no per-run network/firewall,
  no working-directory mount).
• Runs as the same user agent runs use (host uid on Linux, root on
  macOS) so files created in the home volume stay writable for them;
  --root opts out on Linux.
• Warns on entry that only $HOME persists; system packages (apt) belong
  in a custom sandbox Dockerfile.
• Exits with the shell's own exit code.

Sandbox image: point npm's global prefix at /home/agent/.npm-global and
append it and ~/.local/bin to PATH, so npm i -g / pip install --user
from the shell persist across runs. Appended rather than prepended so a
stale install in the shared home can't shadow the image's own binaries.
Requires agent docker build --force to take effect.