# Fix: failed containers shown as running on dashboard

## Problem

Containers that fail during startup (e.g. `ln: failed to create symbolic link '/workspace': Permission denied`) are still displayed as "Running" on the web dashboard and session list.

## Root cause

1. `start_tool_instance` in `apps/api/src/services/tool/instance_service.py` sets `instance.status = "running"` after post-start setup without verifying the container is still up.
2. Generated compose files use `restart: unless-stopped`, so Docker immediately restarts a crashed container, putting it into the `restarting` state.
3. The background `HealthMonitor` treats `restarting` as a transient state and preserves the current DB status (`running`).

## Fix

1. Add a final `get_container_status` check in `start_tool_instance` immediately before writing `status = "running"`. If the container has stopped/exited, mark it as `error` and return the logs.
2. Update `HealthMonitor._derive_status` so that when the DB status is `running` and Docker reports `restarting`, the instance is marked as `error`.
3. Disable auto-restart for tool instances by changing `restart: unless-stopped` to `restart: "no"` in:
   - `apps/api/src/services/build/manifest_compiler.py`
   - `apps/api/src/services/tool/instance_service.py` (legacy dockerfile path)
   - `apps/api/src/seeds/builtin_tool_types.py`

## Affected files

- `apps/api/src/services/tool/instance_service.py`
- `apps/api/src/services/instance/health_monitor.py`
- `apps/api/src/services/build/manifest_compiler.py`
- `apps/api/src/seeds/builtin_tool_types.py`

## Verification

- `pytest apps/api/tests/unit`
- `ruff`, `mypy` on changed files