fix(projections): reconcile current Docker guidance and registry binding

manifests/context-packs/skill-triggers@1.json

@@ -10,7 +10,7 @@
     "id": "hand-seeded",
     "source": "manual-curation-pending-regeneration"
   },
-  "registryDigest": "2f875b395c5ccc302976234366e93d2bb9e284039081de35a702b3566389e791",
+  "registryDigest": "5dd7259b7c6706ef2d6223330654a7dd1bf84893655fddb3d003a56b35b8c18a",
   "schemaVersion": 1,
   "triggers": {
     "skill:agent-runtime-gateway-smoke-test": [

pi/core/skills/docker-patterns/SKILL.md

@@ -409,8 +409,10 @@ docker compose -p ecc-plugin-session \
 Host credentials are absent by default and credential directories are never
 mounted. The default service also has no network access. When an authenticated
 provider session genuinely needs a network, build `real-cli` first and then opt
-in visibly with `docker compose --profile networked run real-cli-networked
-shell`. Prefer authenticating inside that disposable session. If a CI run must
+in visibly with `docker compose -f docker/plugin-setup/compose.yaml
+--profile networked run --service-ports real-cli-networked shell`. The
+`--service-ports` flag publishes the service's loopback callback mapping.
+Prefer authenticating inside that disposable session. If a CI run must
 inherit a host environment credential, make that opt-in at invocation with an
 explicit Compose `--env NAME` flag, understand that the value is inspectable
 and can be exfiltrated for the container lifetime, and remove the exact named
@@ -426,13 +428,17 @@ without a bridge. The `real-cli-networked` service publishes host
 logging in:
 
 ```bash
-npm install --global @openai/codex   # the harness image does not ship codex
+npm install --global @openai/codex@0.162.0   # the harness image does not ship codex
 node /ecc/docker/plugin-setup/codex-auth-relay.js &
 relay_pid=$!
 codex login
 kill "$relay_pid"
 ```
 
+The networked service sets `NPM_CONFIG_PREFIX=/tmp/ecc-npm` and adds its `bin`
+directory to `PATH`. This keeps the pinned installation writable for UID 1000
+on the executable `/tmp` mount while the root filesystem remains read-only.
+
 Complete the sign-in in the host browser. Each attempt mints a fresh
 `state`/`code`, so always follow the newest printed link. The token stays in
 the disposable container's `~/.codex/auth.json`; removing the named container