# Config profile directory mounts

## Problem

`apply_resolved_profile` currently stages each config-profile mount file individually and bind-mounts each file into the container. Docker creates the parent directory (for example `~/.config`) as root-owned when only files are mounted, so applications running as a non-root container user cannot write new files inside that directory.

## Decision

Stage a directory per mount target and bind-mount the whole directory. The staged directory is created under `instance_dir/mounts/` and is chowned to the resolved container user before the container starts, so the container user can create and modify files inside the target directory.

## Scope

- Change `apply_resolved_profile` in `apps/api/src/services/config/config_profile_resolver.py` to emit one directory-level volume mount per `ResolvedMount` target.
- Continue staging all configured files under that directory.
- Preserve read-only mode by setting `readonly: true` on the volume entry when `mode` is `ro`.
- Update unit tests in `apps/api/tests/unit/test_config_profile_resolver.py` to expect directory-level mounts.

## Non-goals

- No changes to git-mount, SSH-key, workspace, or manifest mount handling.
- No changes to config profile storage or resolution semantics.