chore(images): Claude Code 2.1.223, and make the verifier foreground

Reviewed the changelog rather than bumping on principle. 2.1.220 → 2.1.223 for one
reason that bears on how we use subagents:

  2.1.222 — "Fixed PreToolUse auto-allow hooks bypassing tool restrictions in
  background agent tasks."

Subagents run in the background by default since 2.1.198, and the `verifier`
role's entire guarantee is a TOOL restriction — no Edit, no Write. So on 2.1.220
the one property we rely on was the one that bug could undo. 2.1.221 also fixes
`--mcp-config` servers not connecting before the first turn in print mode, which
is the mode we run and will matter when the MCP door reaches a VM.

Two findings from the changelog that we already had at 2.1.220, both worth knowing:
  - 2.1.219: subagents can nest to depth 3 (was 1), so our roles can delegate
    further than assumed.
  - 2.1.212: a subagent inherits the parent's permission mode, which confirms the
    verifier's read-only property must come from `tools` and not from permissions.
    That is how it was written; now the reasoning is recorded next to it.

And a correctness fix that follows from the background default: the verifier is now
`background: false`. A background verifier lets the lead carry on and write its
report before the check has finished — the finding would arrive after the
conclusion it was supposed to inform.

Verified on tank: image reports 2.1.223, rootfs rebuilt, `--vm-selftest` all green
including a real agent turn on subscription auth, egress allow and deny both firing.

crates/cm-api/src/microvm_executor.rs

@@ -149,7 +149,18 @@ fn agent_definitions() -> serde_json::Value {
             // No Edit and no Write, by construction: an agent that can fix what it
             // is checking will fix it and report success, and the report is then
             // about a tree nobody reviewed.
+            //
+            // This restriction is enforced by the tool allowlist, NOT by permission
+            // mode — since 2.1.212 a subagent inherits the parent's permission mode,
+            // so `acceptEdits` reaches it either way. It is also why the image is
+            // pinned to 2.1.223: 2.1.222 fixed background subagents being able to
+            // bypass tool restrictions, and this is the tool restriction in question.
             "tools": "Read, Grep, Glob, Bash",
+            // Foreground, against the default since 2.1.198. A background verifier
+            // lets the lead carry on and write its report before the check has
+            // finished — the finding would arrive after the conclusion. The whole
+            // point is that the verdict comes from the verifier, so the lead waits.
+            "background": false,
             "prompt": format!(
                 "You verify work you did not do. You are given an artifact and the \
                  criteria it must meet, and nothing else — you do not know how it was \
@@ -479,6 +490,14 @@ mod tests {
             );
         }
         assert!(tools.contains("Bash"), "it has to be able to run the suite: {tools}");
+        // Subagents default to background since 2.1.198. A background verifier lets
+        // the lead write its conclusion before the check finishes, so the finding
+        // would arrive after the report that was supposed to contain it.
+        assert_eq!(
+            defs["verifier"]["background"],
+            serde_json::json!(false),
+            "the lead must wait for its verifier"
+        );
     }
 
     /// The early-victory failure: a verifier that stops after the first passing

images/agent-claude/Dockerfile

@@ -18,7 +18,16 @@ FROM clawmates/agent-toolchain:dev
 
 # Pinned: an unpinned `npm i -g` makes the image's behaviour depend on the day
 # it was built, and a mission that regresses would have no version to compare.
-ARG CLAUDE_CODE_VERSION=2.1.220
+#
+# 2.1.223, up from 2.1.220, for one reason that matters to how we use subagents:
+# 2.1.222 "Fixed PreToolUse auto-allow hooks bypassing tool restrictions in
+# background agent tasks". Subagents run in the background by default since
+# 2.1.198, and our `verifier` role's whole guarantee is a TOOL RESTRICTION — no
+# Edit, no Write — so on 2.1.220 the one property we rely on was the one the bug
+# could undo. 2.1.221 also fixes `--mcp-config` servers not connecting before the
+# first turn in print mode, which is exactly the mode we run and will matter when
+# the MCP door reaches a VM.
+ARG CLAUDE_CODE_VERSION=2.1.223
 RUN npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
     && npm cache clean --force \
     && rm -rf /root/.npm \