cm-runtime/cm-sandbox tests shell out to `docker` via std::process, so the mounted socket alone was not enough — browser_tool failed with `docker available: NotFound`. Mount the host binary rather than apt-installing docker.io: the container is fresh every run, so an install would re-download ~100 MB each time and cache nothing. Verified on gw-04 that a mounted /usr/bin/docker talks to the host daemon (client=29.1.3 server=29.1.3), and that the agent-*:dev images these tests need are already present there. Co-Authored-By: Claude Opus 5 <[email protected]>