feat(uno-q): expose participant files to the agent + document mux scan

- Mount each student's own App Lab files into the app container so the
  agent can read/fix them: mount-user-workspace.sh binds ~/sketches (rw),
  ~/ArduinoApps/* (rw), ~/Arduino/libraries (ro) under /app/workspace via
  a root oneshot ordered before arduino-app-cli.service (the /app bind is
  rprivate, so binds must precede container start; App Lab has no app.yaml
  volumes field). Wired into provision-node-app, provision-fleet (systemd,
  best-effort sudo), and package-onboard-app (bundled under host-setup/).
- uno-q-hardware skill: document the mux-aware i2c_scan output format
  (0x70:mux, 0x70.2=0x1d) and tell the agent its student's files live at
  /app/workspace. See USER-WORKSPACE.md.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

deploy/uno-q/package-onboard-app.sh

@@ -58,6 +58,17 @@ ok "config (single 'default' agent, matrix + i2c_scan)"
 cp -r "$HERE/skills" "$OUT/.zeroclaw/shared/skills"
 ok "skills ($(ls "$HERE/skills" | wc -l | tr -d ' ') bundles)"
 
+# Host-setup helpers that CAN'T ride the container: the participant-workspace
+# bind-mount (root, before app start) that exposes ~/sketches + ~/ArduinoApps +
+# libraries at /app/workspace so the agent can fix student code. App Lab import
+# can't run these (no root), so they travel in host-setup/ for a one-time enable.
+mkdir -p "$OUT/host-setup/systemd"
+cp "$HERE/mount-user-workspace.sh"                 "$OUT/host-setup/mount-user-workspace.sh"
+cp "$HERE/systemd/apess-user-workspace.service"    "$OUT/host-setup/systemd/apess-user-workspace.service"
+cp "$HERE/USER-WORKSPACE.md"                        "$OUT/host-setup/README.md"
+chmod +x "$OUT/host-setup/mount-user-workspace.sh"
+ok "host-setup/ (participant-workspace mount — enable once per board, needs root)"
+
 # BAKED cloud token (per the workshop decision) — the instructor's Max token,
 # shared across the fleet. Kept in the app bundle only, never in the repo.
 printf '%s' "$ANTHROPIC_OAUTH_TOKEN" > "$OUT/.zeroclaw/oauth_token"
@@ -104,6 +115,15 @@ Distribute it:
     Students download it, open App Lab → "Import an app" → pick the zip → Run.
   • Instructor smoke-test on a board:
       arduino-app-cli app import "$ZIP"
+  • Expose participant files to the agent (/app/workspace) — one-time, needs root
+    (App Lab import can't do this itself). On each board after import:
+      adb push <app>/host-setup/mount-user-workspace.sh /home/arduino/ && \\
+      adb shell 'chmod +x /home/arduino/mount-user-workspace.sh' && \\
+      adb push <app>/host-setup/systemd/apess-user-workspace.service /tmp/ && \\
+      adb shell 'sudo install /tmp/apess-user-workspace.service /etc/systemd/system/ \\
+        && sudo systemctl enable --now apess-user-workspace.service \\
+        && arduino-app-cli app restart /home/arduino/ArduinoApps/apess-onboard'
+    Fleet boards: provision-fleet.sh does this automatically (MODE=systemd). See host-setup/README.md.
   • APESS_URL: default is mDNS apess-api.local. Set per team by editing
     .zeroclaw/apess-node.env before packaging, or pass APESS_URL=http://<laptop>:3000.
 EOF