fix(docker): mount plugins at /work/plugins/<i> and point the staged task there

[akshaylive]

Problem

Under driver: docker, the runner resolved each agent.plugins[].path on the host and mounted it at the same host path. But the task.yaml staged into the container kept the path as authored, and the in-container agent resolved it again against the container's cwd. As a result, a relative or $VAR plugin path silently loaded no skill:

• Relative path, such as plugin or ./plugin: the host mounted it correctly, but inside the container the path pointed at a directory that doesn't exist. Codex logged Plugin skills path did not resolve: ... (path does not exist), and Claude loaded nothing.
• ${VAR}/plugin: it works only if VAR is in the real host environment (not just .env) and is forwarded into the container. Otherwise it isn't expanded, so nothing is mounted and nothing loads.

Only absolute host paths worked end to end. The failure isn't obvious, because the run still grades normally, just without the skill.

Fix

• Mount point: plugin i is mounted :ro at /work/plugins/<i>, a new CONTAINER_PLUGINS_DIR constant, which is also added to RESERVED_CONTAINER_DIRS. It sits under /work, so the existing extra_mounts check (which refuses destinations under /work/) stops a task from shadowing a plugin mount.
• Staged task: _stage_inputs rewrites plugin i's path in the staged task.yaml to /work/plugins/<i>. The host-side task isn't modified.
• One shared mapping: both steps use one helper, _plugin_mounts(), which gives each plugin's host directory and container path, so the mount and the rewrite can't disagree. Host-side resolution is unchanged (_resolve_mount_path: a relative path resolves against the task YAML's directory, and $VAR and ~ are expanded).
• Masks: the tmpfs masks that hide non-skill folders now sit under the plugin's container path, and a nested plugin root still keeps its own bind.
• Unresolved entries: a plugin that doesn't resolve to a host directory is neither mounted nor rewritten, same as before.
• Docs: docs/DOCKER_ISOLATION.md is updated.

Testing

• Unit tests: the three TestAutoMountAllowlistMask tests now assert container-path binds and masks. The new test_the_staged_task_yaml_points_plugins_at_their_container_mounts covers the task.yaml rewrite.
• Full suite: uv run pytest gives 6727 passed and 1 failed, test_codex_golden[g_items_rebuild], which fails on main too.
• Pyright: make verify still reports one error, harbor/agent.py:65 (SUPPORTS_ATIF), which is also on main.
• End to end: a real driver: docker task with plugins: [{type: local, path: plugin}], run on claude-code (claude-sonnet-5) and codex (gpt-5.6-luna). Both got the bind …/plugin:/work/plugins/0:ro, loaded the skill, and passed:
  • Claude's Skill call succeeded, and it ran the skill's scripts from /work/plugins/0/skills/….
  • Codex logged Linked skill: copilot-usage-metrics.
  • Without this change, the same task loaded no skill on either harness.

🤖 Generated with Claude Code