feat: MCP in containers — cloakbrowser-mcp + chromium libs baked, mcp.json standard config, shared host chromium cache mounted ro; playwright via npx

docker/control.Dockerfile

@@ -8,6 +8,9 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends \
     bash ca-certificates git ripgrep curl xz-utils make jq golang-go \
     docker.io \
+    libglib2.0-0 libnss3 libnspr4 libatk1.0-0 libatk-bridge2.0-0 \
+    libcups2 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 \
+    libxfixes3 libxrandr2 libgbm1 libpango-1.0-0 libcairo2 libasound2 \
   && rm -rf /var/lib/apt/lists/*
 
 RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
@@ -34,6 +37,11 @@ COPY docker/bridge /bridge
 COPY docker/ops-context/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
+# MCP tooling (same as workers; ops also browses).
+RUN npm-real install -g --ignore-scripts cloakbrowser-mcp@1.4.0 \
+	&& mkdir -p /root/.config/mcp
+COPY docker/mcp.json /root/.config/mcp/mcp.json
+
 ENV PI_SESSION_DIR=/pi-sessions
 WORKDIR /ops
 ENTRYPOINT ["/entrypoint.sh"]