Generate a Linux container setup script from the tooling registry

[ExtraToast]

Design: JorisJonkers-dev/agents-api#59 (the glossary and ADRs). Use the glossary's terms.

What to build

The agents image will install every tool from the same registry that drives the workstation setup, instead of the runner Dockerfile's hand-written installs. Extend the generator so that the tooling registry also emits a Linux container setup script. The script has no Homebrew, no launchd and no interactive steps, runs at image build time, and installs Claude, Codex, the Hermes CLI, the MCP servers, language servers and the other CLIs the runner image has today. Every tool version is pinned in the registry, and Renovate can bump it.

Implements part of ADR 0001: Agent Sessions run inside the API container.

Acceptance criteria

• The generator emits the container setup script from the registry, and CI fails if the committed script is stale.
• Running the script in a clean Debian container as root succeeds, and its check mode then reports every tool present.
• No secret is read or written at build time. Secret-dependent registration (such as memory or Overleaf MCP) is deferred to container start.
• Every tool version is pinned in the registry, and Renovate is configured to bump the pins.
• The workstation script's output is unchanged.

Blocked by

None (can start immediately)