build(runtime): pin Claude Code 2.1.276 and Kimi 0.41.0; missions run the image we ship

Two things found while asking "what version of Claude Code do missions run?"

Mission containers are created from CLAWMATES_RUNTIME_IMAGE, which on both
stacks still pointed at clawmates-runtime:hooks — zeroclaw 0.8.4, Claude Code
2.1.237 (2.1.228 locally), built 2026-08-21. The v0.8.5 upgrade on 09-06
rebuilt only the persistent clawmates-runtime container, which container-tier
missions do not drive their turns through. Every measured mission this month
ran on 0.8.4/2.1.237; the measurements stand (one image throughout) but the
version attached to them in the handoff and in memory was wrong, and has been
corrected there.

The drift itself came from `npm install -g @anthropic-ai/claude-code` with no
version: each rebuild takes whatever npm has that day, so two builds three
weeks apart shipped two CLIs and nothing recorded either. The changelog shows
why that is not merely untidy — 2.1.265 and 2.1.275 each broke every turn on
ANTHROPIC_BASE_URL endpoints, the path the GLM and Kimi backends use — and
today's floating local build silently took Kimi 2.0.1, a major version. Both
are ARGs now, defaulting to what was verified.

Verified before promoting: two local missions on 0.8.5 + 2.1.276 — tool
arguments recorded on 40/40 and 123/123 calls, gate.installed, skill reads,
judge met and independent with the correction loop closing, spend rows with
provider and model, and with delegation forced, 4 Agent spawns → 45 subagent
calls across 4 ids all typed general-purpose (44/4 on the old CLI). The hook
payload did not move. Prod's .env now names clawmates-runtime:v085-cc276,
built on tank from the fork at 57635deb with this Dockerfile.

The local override's CLAWMATES_RUNTIME_IMAGE points at :toolchain, which is
the same lineage plus cmake/python3-dev for `cargo test` on cmake-driven deps.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz

deploy/compose/docker-compose.override.yml

@@ -156,7 +156,7 @@ services:
       # the agents build the user's repo inside them. The built-in default is
       # `clawmates-runtime:sync` (mission_runtime.rs DEFAULT_IMAGE), which has
       # no cmake, so a coding phase could not compile clawhdf5 at all.
-      CLAWMATES_RUNTIME_IMAGE: clawmates-runtime:hooks
+      CLAWMATES_RUNTIME_IMAGE: clawmates-runtime:toolchain
       # Per-mission containers default to forwarding ANTHROPIC_API_KEY, which is
       # dead here ("credit balance is too low"). Claude Code ranks that key ABOVE
       # the subscription token, so forwarding it doesn't just fail — it WINS over