Extract clanker-cleanroom monorepo with unified Agent API

[devzeebo]

Summary

• Split the repo into a pnpm workspace with two packages: clanker-cleanroom (Docker image build/run and agent bindings) and agent-gwt (GWT step functions for repeatable agent tests).
• Introduce a unified new Agent(name) API backed by a registry that records stock and toolchain image tags, so callers no longer pass variant or base-agent options.
• Replace ad-hoc image build helpers with a Dockerfile DAG (buildImages) that topo-sorts local FROM tags, builds once, and writes clanker-cleanroom.images.json at the project root; update CI publish workflow and docs accordingly.

Test plan

• pnpm install
• pnpm run build
• pnpm run test
• pnpm run lint
• pnpm run test:e2e (requires Docker and agent credentials)

[devzeebo]

Summary

Strong refactor — the monorepo split is clean, the Agent(name) + registry model is a clear improvement over the old variant / per-agent build helpers, and test coverage on the Dockerfile DAG + registry path is solid. I ran pnpm run test and pnpm run lint locally; both pass.

Highlights

• Separation of concerns — clanker-cleanroom owns Docker/build/run; agent-gwt stays a thin GWT layer. Good boundary.
• buildImages DAG — topo-sort + registry JSON is simpler and more extensible than the old buildAgentImage / buildToolchainImage split.
• Backward-compat re-exports — agent-gwt re-exporting the cleanroom surface should ease migration for existing consumers.
• CI — dual-package version sync and publish ordering (clanker-cleanroom first) look right for prereleases.

Blockers / should-fix before merge

1. Release staging leaves agent-gwt depending on a prerelease clanker-cleanroom — see inline comment on publish.yml.
2. Stale variant reference in context7.json — removed from the API but still in rules.

Suggestions (non-blocking)

• Add a short migration note to the PR description or README covering: image tag renames (agent-gwt/*:local → clanker-cleanroom/*), variant → registry tag names, buildAgentImage/buildToolchainImage → buildImages, and ClaudeAgentResult removal in favor of AgentRunResult.
• Agent.buildImage() doesn't forward packageRoot — minor edge case if callers use a non-cwd registry.
• Consider dedicated unit tests for inferAgent error paths (cycle / unresolvable FROM chain); currently only covered indirectly via build.spec.ts.

Pre-merge checklist

• Bootstrap clanker-cleanroom on npm + trusted publisher (per PUBLISHING.md)
• Fix release workflow dependency rewrite
• Update context7.json rule