[AhmedSalem104]

Summary

• Adds an opt-in build-only Agent mode with an allowlisted API surface and direct HTTPS endpoint mounting.
• Requires a dedicated Unix Docker socket and matching Docker data-root; rejects default or aliased host sockets, symlinks, context/TLS overrides, and unreachable/mismatched daemons.
• Revalidates the configured daemon in the worker before image build, upload, patch, and push operations so a bad worker environment fails closed.
• Adds configurable ports and stdin-based Agent token setup for provisioning.

Validation

• Focused isolated build-only tests: 9 passed.
• Python AST and git diff --check: passed.
• Full Agent suite not run: project dependencies/environment are not installed locally. No T2/Press Production services changed.