feat: implement configurable tool container home directory

- Add ToolType.home_directory column with default /home/user
- Add Alembic migration to add column, set existing rows, and rewrite
  /workspace to /home/user/{{WORKSPACE_NAME}} in legacy templates
- Add merge migration fc8f1a20cbf6 to resolve Alembic multiple heads
- Update manifest compiler to honor manifest.home_directory for HOME,
  WORKDIR, /workspace symlink, and default repo mount target
- Update legacy dockerfile/compose instance generation to use
  tool_type.home_directory
- Thread resolved home_dir through config profile and git mount expansion
- Generate entrypoint permission fixer to chown home/mounts at startup
- Update base.dockerfile with sudo/passwordless sudo for permission fixer
- Add unit tests for manifest compiler, instance service, and migrations
- Add placeholder integration test for container lifecycle
- Update openspec/tasks/home-path-expansion.md task checkboxes
- Update project maps for modified files

Quality gates: py_compile, ruff, mypy, pytest tests/unit (205 passed),
pytest tests/integration (110 passed, 35 skipped). Alembic round-trip
and container lifecycle integration tests require Docker/PostgreSQL.

apps/api/src/services/tool/instance_service.py

@@ -9,7 +9,6 @@ import subprocess
 import uuid
 from datetime import datetime
 
-import httpx
 from fastapi import HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -33,7 +32,6 @@ from src.services.docker import (
     get_container_id,
     get_container_ip_on_network,
     get_container_logs,
-    get_container_status,
     is_container_on_network,
     render_compose_template,
     sort_volumes_by_specificity,
@@ -64,10 +62,9 @@ from src.services.shared.permission_fixer import (
     apply_ssh_permissions,
 )
 from src.services.shared.readiness_probe import execute_probe
-from src.services.shared.ssh_keys import cleanup_ssh_key_files, prepare_ssh_key_files
+from src.services.shared.ssh_keys import prepare_ssh_key_files
 from src.services.instance.event_bus import InstanceEventBus
 from src.services.instance.lifecycle_hooks import publish_lifecycle_event
-from src.auth.dependencies import _get_owned_project, _get_user
 
 logger = logging.getLogger(__name__)
 _event_bus = InstanceEventBus()
@@ -139,7 +136,7 @@ async def resolve_git_mounts(
         if isinstance(result, Exception):
             logger.warning("Git mount failed: %s", result)
             continue
-        if result:
+        if isinstance(result, list):
             volume_mounts.extend(result)
 
     return volume_mounts
@@ -1043,7 +1040,11 @@ async def create_tool_instance(
             else ""
         )
 
-        compose_content = f"""version: "3.8"\nservices:\n  app:\n    image: {image_tag}\n    container_name: {instance_name.lower()}\n    stdin_open: true\n    tty: true\n{ports_section}    volumes:\n      - {repo_path}:/workspace\n    restart: unless-stopped\n"""
+        home_dir = tool_type.home_directory or "/home/user"
+        repo_name = os.path.basename(os.path.normpath(repo_path))
+        workspace_target = f"{home_dir}/{repo_name}"
+
+        compose_content = f"""version: "3.8"\nservices:\n  app:\n    image: {image_tag}\n    container_name: {instance_name.lower()}\n    stdin_open: true\n    tty: true\n{ports_section}    environment:\n      - HOME={home_dir}\n    volumes:\n      - {repo_path}:{workspace_target}\n    working_dir: {workspace_target}\n    restart: unless-stopped\n"""
         write_compose_file(instance_dir, compose_content)
 
     elif tool_type.definition_type == "manifest":
@@ -1095,6 +1096,8 @@ async def create_tool_instance(
             "TOOL_PORT": tool_port,
             "USER_ID": str(user_id),
             "PROJECT_ID": str(project_id),
+            "WORKSPACE_NAME": os.path.basename(os.path.normpath(repo_path)),
+            "HOME_DIRECTORY": tool_type.home_directory or "/home/user",
         }
         compose_content = render_compose_template(
             tool_type.compose_template, variables