ci: put the docker CLI on PATH for the sandbox integration tests

cm-runtime/cm-sandbox tests shell out to `docker` via std::process, so the
mounted socket alone was not enough — browser_tool failed with
`docker available: NotFound`. Mount the host binary rather than apt-installing
docker.io: the container is fresh every run, so an install would re-download
~100 MB each time and cache nothing.

Verified on gw-04 that a mounted /usr/bin/docker talks to the host daemon
(client=29.1.3 server=29.1.3), and that the agent-*:dev images these tests need
are already present there.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/workflows/deploy.yml

@@ -50,11 +50,20 @@ jobs:
       # Rust lives in a container because gw-04 has no cargo. The named volumes
       # are the whole reason this is not painfully slow: without them every run
       # recompiles the world.
-      # The docker socket is mounted because cm-files' s3_store test uses
-      # testcontainers to spin up a real MinIO. Without it the test does not skip
-      # — it fails with SocketNotFoundError, which reads like a broken test
-      # rather than a missing capability. Sibling containers it starts are
-      # reachable because this container shares the host network.
+      # Docker socket AND the host's docker binary are mounted:
+      #   - cm-files' s3_store test uses testcontainers (socket only).
+      #   - cm-runtime/cm-sandbox tests (browser_tool, shell_exec, warm_pool,
+      #     security, socket_proxy) shell out to `docker` via std::process, so
+      #     they need the CLI on PATH too. Mounting the host binary beats
+      #     apt-installing docker.io on every run — that is ~100 MB of download
+      #     per job, and the container is fresh each time so nothing caches it.
+      # These tests do NOT skip when the capability is missing; they fail in a
+      # way that reads like broken code (SocketNotFoundError / NotFound), which
+      # is why they are worth wiring up rather than excluding.
+      #
+      # They also need clawmates/agent-{base,browser,terminal}:dev, which are
+      # locally-built images present on gw-04 but in no registry. If this job
+      # ever moves hosts, those images must move with it.
       #
       # `cargo test --workspace` builds cm-brain, which pulls clawhdf5 from
       # git.redclaw.dev — a PRIVATE repo. Two things are needed and neither is
@@ -72,6 +81,7 @@ jobs:
             -v cm-ci-cargo-git:/usr/local/cargo/git \
             -v cm-ci-target:/w/target \
             -v /var/run/docker.sock:/var/run/docker.sock \
+            -v /usr/bin/docker:/usr/bin/docker:ro \
             -e SQLX_OFFLINE=true \
             -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
             -e FORGE_TOKEN='${{ secrets.FORGE_TOKEN }}' \