fix: prevent failed containers from showing as running on dashboard

- Add final get_container_status check in start_tool_instance before
  writing status=running; mark as error and return logs if container stopped
- Treat restarting as error in HealthMonitor when DB status was already
  running, so crash loops are surfaced instead of preserved
- Disable auto-restart (restart: unless-stopped -> restart: no) for tool
  instances in manifest compiler, legacy dockerfile path, and built-in seeds

Quality gates:
- pytest tests/unit: 210 passed
- ruff: clean on changed files
- mypy: clean on changed files

openspec/changes/fix-container-status-false-positive/change.md

@@ -0,0 +1,32 @@
+# Fix: failed containers shown as running on dashboard
+
+## Problem
+
+Containers that fail during startup (e.g. `ln: failed to create symbolic link '/workspace': Permission denied`) are still displayed as "Running" on the web dashboard and session list.
+
+## Root cause
+
+1. `start_tool_instance` in `apps/api/src/services/tool/instance_service.py` sets `instance.status = "running"` after post-start setup without verifying the container is still up.
+2. Generated compose files use `restart: unless-stopped`, so Docker immediately restarts a crashed container, putting it into the `restarting` state.
+3. The background `HealthMonitor` treats `restarting` as a transient state and preserves the current DB status (`running`).
+
+## Fix
+
+1. Add a final `get_container_status` check in `start_tool_instance` immediately before writing `status = "running"`. If the container has stopped/exited, mark it as `error` and return the logs.
+2. Update `HealthMonitor._derive_status` so that when the DB status is `running` and Docker reports `restarting`, the instance is marked as `error`.
+3. Disable auto-restart for tool instances by changing `restart: unless-stopped` to `restart: "no"` in:
+   - `apps/api/src/services/build/manifest_compiler.py`
+   - `apps/api/src/services/tool/instance_service.py` (legacy dockerfile path)
+   - `apps/api/src/seeds/builtin_tool_types.py`
+
+## Affected files
+
+- `apps/api/src/services/tool/instance_service.py`
+- `apps/api/src/services/instance/health_monitor.py`
+- `apps/api/src/services/build/manifest_compiler.py`
+- `apps/api/src/seeds/builtin_tool_types.py`
+
+## Verification
+
+- `pytest apps/api/tests/unit`
+- `ruff`, `mypy` on changed files