control which OC-related host directories are mounted

[thejoeejoee]

Right now jailoc unconditionally mounts host directories into the container:

- ~/.config/opencode:/home/agent/.config/opencode:ro
- ~/.opencode:/home/agent/.opencode:ro
- ~/.claude:/home/agent/.claude
- ~/.agents:/home/agent/.agents:ro

There's no way to:

1. Opt out — skip mounting host OC/Claude config entirely (use container-local config instead)
2. Control per-mount — e.g. share .config/opencode but not .claude
3. Share .local from host — persist agent state (MCP servers, tool caches, shell history) across container recreations without relying on named volumes that are invisible and hard to inspect

Why this matters

• Reproducibility: mounting host config means the container behaves differently on every machine. For teams sharing workspace configs, container-local settings are more predictable.
• Persistence: named volumes (opencode-data-*, opencode-cache-*) work but are opaque. Some users want ~/.local bind-mounted so they can inspect, back up, or share state across workspaces.

Proposal

New config fields under [defaults] and per-workspace:

[defaults]
# Control which host dirs get mounted (default: all true for backward compat)
mount_opencode_config = true   # ~/.config/opencode, ~/.opencode (ro)
mount_claude_config = true     # ~/.claude (rw → ro?)
mount_agent_skills = true      # ~/.agents (ro)

# Bind-mount host .local instead of using anonymous named volumes
share_local = false            # ~/.local/share/opencode → bind-mount instead of volume

[workspaces.isolated]
mount_opencode_config = false  # this workspace gets no host config
mount_claude_config = false

Alternatively — single field

[defaults]
# Which host directories to mount into the container
# Options: "all" (default), "none", or explicit list
host_mounts = ["opencode-config", "agent-skills"]
# Omitting "claude-config" means ~/.claude is NOT mounted

.local sharing

When share_local = true:

# Instead of:
- opencode-data-ws:/home/agent/.local/share/opencode
# Use:
- ${HOME}/.local/share/jailoc/ws:/home/agent/.local

This makes agent state inspectable and portable.

Open questions

• Should .claude default to ro instead of rw? Current rw means the agent can modify host Claude credentials.
• Single toggle (host_mounts list) vs granular booleans?
• Should share_local be per-workspace or global only?
• If no config is mounted, how does the agent authenticate? Require env vars (ANTHROPIC_API_KEY etc.) via env/env_file?