Experimental: replace AppContainer with mandatory Docker sandbox

[yikkuro (yikkuro)]

Summary

• Replaces AppContainer as the active tool-isolation path with OpenClaw's built-in Docker sandbox.
• Enforces Docker-only policy before Gateway startup/reconnect and every agent invocation.
• Uses agent-scoped containers and adds per-agent Windows folder bindings in Settings → Security.
• Adds bounded WSL2, Docker Desktop, Linux-container, and pinned-image checks plus user-triggered image provisioning.
• Removes AppContainer permission/ACL UI, packaging/build/CI resources, and installer provisioning.

Security posture

Enforces mode: all, Docker backend, scope: agent, workspaceAccess: none, pinned microclaw-openclaw-sandbox:2026.7.1-1, read-only root, non-root user, dropped capabilities, resource limits, network: none, tools.exec.host: sandbox, elevated tools disabled, ACP disabled, and a conservative sandbox tool allowlist.

Per-agent folder grants use only the native directory picker. Main-process validation canonicalizes paths, resolves reparse targets, rejects missing/overlapping/broad/system/state/credential locations, deduplicates case-insensitively, and generates collision-safe /mnt/microclaw/... targets. Docker enforces ro/rw; no arbitrary container target is accepted. dangerouslyAllowExternalBindSources is enabled only on agents with validated managed bindings.

Binding mutations are serialized and atomically persisted. The managed Gateway restarts to acknowledge the config, then only the selected agent's sandbox runtimes are recreated. Durable pending/error state blocks execution until recreation succeeds; desired config remains visible for retry. Scope migration recreates runtimes and removes only orphaned OpenClaw containers whose mounts belong to this exact state directory.

MicroClaw rejects unowned Gateways. Missing WSL2/Docker/Linux-container/image readiness fails Gateway/chat/agent execution closed, with no host or AppContainer fallback.

Validation

• Desktop tests: 795 passed; renderer tests: 249 passed.
• Focused Docker tests: 12 passed; focused Settings/browser tests: 5 passed.
• Desktop TypeScript and renderer Vue TypeScript/Vite production build passed.
• Changed-file ESLint (0 errors), Prettier, and git diff --check passed.
• Docker Desktop live validation passed with the pinned image:
  • migration produced scope=agent and removed five orphaned state-owned session containers;
  • main-agent RO bind read succeeded and write failed with Read-only file system;
  • changing the bind to RW allowed a sandbox tool to write rw-live-ok;
  • the coder agent reported the main-only target absent;
  • removing the bind made the target absent;
  • final containers retain user 1000:1000, read-only root, network=none, capDrop=ALL, no-new-privileges, and no elevated access.

This PR does not install/elevate/reboot/accept licensing for Docker or WSL, and does not retain AppContainer or host execution as fallback.

Related: closed prerequisite-only PR #196.