fix: stage config-profile mounts as directories so ~/.config stays writable

- Switch apply_resolved_profile from per-file bind mounts to one
  directory-level bind mount per ResolvedMount target.
- Stage all configured files under instance_dir/mounts/<sanitized_target>
  and bind-mount that directory, so Docker no longer creates a root-owned
  parent directory such as ~/.config.
- Propagate read-only mode ('ro') as the 'readonly' flag on volume entries.
- Update unit tests to expect directory-level mounts and add coverage for
  readonly/writable flags.

Quality gates: python3 -m py_compile, pytest (313 passed, 34 skipped),
npm run typecheck, npm run lint.
This commit is contained in:
Developer
2026-06-13 11:56:48 +00:00
parent d78ca8a9d5
commit d395aaf574
21 changed files with 206 additions and 53 deletions
@@ -2,7 +2,7 @@
dir: apps/api/src/services/config
## role
Provides configuration profile resolution and management services for the API, handling hierarchical config merging, validation, and access control.
Provides configuration profile management with recursive resolution, validation, and access control for container environment setup.
## parent
index: apps/api/src/services/.pi-map.index.md
map: apps/api/src/services/.pi-map.md