feat: let a profile name the runner, so Apple's container works

[tkc]

Profiles were hard-wired to docker run. The argument spelling termit emits (-v, -w, -e, --network, -it, --rm) is not Docker-specific, so a profile can now name the command instead.

[profile.vm]
image       = "termit-agent:latest"
runner      = "container"              # Apple's container: one lightweight VM each
mount       = ["{cwd}:/work"]
env         = ["ANTHROPIC_API_KEY", "TERM"]
runner_args = ["--memory", "2048MB"]   # inserted just before the image

• runner defaults to docker, so existing configs are unchanged.
• runner_args is the escape hatch for flags termit knows nothing about.
• network is now passed only when set: the name differs per runner (docker bridge, container default) and both reach the network by default. network = "none" under Docker still closes it.
• No runner name appears in the code except as that default. termit still only assembles an argument list.

Verified against Apple's container 1.4.1

An #[ignore]d test spawns a real container through termit's own pty path and asserts both that guest output reaches the grid and that stty size inside reports 40 120:

cargo test -- --ignored コンテナの中の出力が届く --nocapture

Measured while trying it:

First run (image pull included)	15.1 s
Warm start	0.74 s (a whole VM)
Interactive prompt through a pty	1.02 s
Idle cost, no containers	apiserver 24 MB + core-images 22 MB
Per container	~21 MB host-side, guest defaults to 4 CPUs / 1024 MB

The caveat, documented rather than worked around

For about the first second the guest terminal size is 0 0; the real size arrives after that, and later resizes propagate correctly:

t1: 0 0        <- immediately after start
t2: 40 120     <- one second later
t6: 50 200     <- after a host-side resize + SIGWINCH

So a full-screen UI that reads its size once at startup can come up at 80 columns. Re-sending the same size raises no SIGWINCH, so a fix inside termit would have to jiggle the size and flicker the screen. Config avoids it instead:

[agent]
new = "sh -c 'sleep 1.5; exec claude --session-id {new_id}'"

Upstream has no issue for this (apple/container#1747 is about SIGWINCH forwarding errors, a different thing).

Docs

docs/references/sandbox.md is new: the six isolation levels from Anthropic's own comparison, how sbx (Docker Sandboxes) differs — microVM per session, credentials kept on the host and injected at a proxy, --branch auto worktrees — the container measurements above, and what termit deliberately leaves outside:

• sbx-shaped argument lists — sbx run <agent> does not fit; supporting it means generalising to a command template and giving up the image/mount/network vocabulary. Decide when it is actually needed.
• git worktree per fork — the terminal would start understanding git; [agent] fork can run git worktree add itself.
• credential injection — env is as strong as the host, and that is now said plainly rather than implied.

README and the design spec follow the same change.

Test

cargo test — 206 pass, 1 ignored (the container one). cargo clippy --all-targets -- -D warnings and cargo fmt --check — clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GvMacYD6T9EoWqc7C247Hr