T126: Docker agent code setup — agent profile to .env + manifest install (thin daemon)

[pulzzejason]

E2 of the daemon work (code setup). After E1 clones a repo, make it build/test-ready. Thin-daemon design: the server resolves setup steps; the daemon just executes.

• Server: GET …/agent-profile also returns setup {install[],generate[]} + envRequired, parsed server-side from pm-agent.yaml (or default-inferred: lockfile→npm ci, Prisma→generate). Smarts live in src/, ship via deploys.
• Daemon (thin, no new dep): write .env from the env map (0600), run setup.install/generate, idempotent (re-run only on profile change). No YAML parser in the image.

Out of scope: claim/run-Claude (E3), test/e2e, services/isolation, Claude manifest generation. Stacked on E1 (#450); validated locally; batched deploy later.