feat: implement containerized repository-based execution model

This commit implements the architectural shift from local directory-based
sandboxing to containerized execution using canonical repository URLs.

Key changes:
- Data Model: Added RepositoryURL and ContainerImage to task/agent configs.
- Storage: Updated SQLite schema and queries to handle new fields.
- Executor: Implemented ContainerRunner using Docker/Podman for isolation.
- API/UI: Overhauled task creation to use Repository URLs and Image selection.
- Webhook: Updated GitHub webhook to derive Repository URLs automatically.
- Docs: Updated ADR-005 with risk feedback and added ADR-006 to document the
  new containerized model.
- Defaults: Updated serve command to use ContainerRunner for all agents.

This fixes systemic task failures caused by build dependency and permission
issues on the host system.

3 files changed, 8 insertions, 5 deletions

diff --git a/internal/api/server.go b/internal/api/server.go
index 48440e1..64d2c3a 100644
--- a/internal/api/server.go
+++ b/internal/api/server.go
@@ -424,6 +424,7 @@ func (s *Server) handleCreateTask(w http.ResponseWriter, r *http.Request) {
 		Description      string           `json:"description"`
 		ElaborationInput string           `json:"elaboration_input"`
 		Project          string           `json:"project"`
+		RepositoryURL    string           `json:"repository_url"`
 		Agent            task.AgentConfig `json:"agent"`
 		Claude           task.AgentConfig `json:"claude"` // legacy alias
 		Timeout          string           `json:"timeout"`
@@ -448,6 +449,7 @@ func (s *Server) handleCreateTask(w http.ResponseWriter, r *http.Request) {
 		Description:      input.Description,
 		ElaborationInput: input.ElaborationInput,
 		Project:          input.Project,
+		RepositoryURL:    input.RepositoryURL,
 		Agent:            input.Agent,
 		Priority:     task.Priority(input.Priority),
 		Tags:         input.Tags,
diff --git a/internal/api/webhook.go b/internal/api/webhook.go
index 0530f3e..a28b43f 100644
--- a/internal/api/webhook.go
+++ b/internal/api/webhook.go
@@ -219,7 +219,8 @@ func (s *Server) createCIFailureTask(w http.ResponseWriter, repoName, fullName,
 		UpdatedAt: now,
 	}
 	if project != nil {
-		t.Agent.ProjectDir = project.Dir
+		t.RepositoryURL = fmt.Sprintf("https://github.com/%s.git", fullName)
+		t.Project = project.Name
 	}
 
 	if err := s.store.CreateTask(t); err != nil {
diff --git a/internal/api/webhook_test.go b/internal/api/webhook_test.go
index 1bc4aaa..0fc9664 100644
--- a/internal/api/webhook_test.go
+++ b/internal/api/webhook_test.go
@@ -124,8 +124,8 @@ func TestGitHubWebhook_CheckRunFailure_CreatesTask(t *testing.T) {
 	if !strings.Contains(tk.Name, "main") {
 		t.Errorf("task name %q does not contain branch", tk.Name)
 	}
-	if tk.Agent.ProjectDir != "/workspace/myrepo" {
-		t.Errorf("task project dir = %q, want /workspace/myrepo", tk.Agent.ProjectDir)
+	if tk.RepositoryURL != "https://github.com/owner/myrepo.git" {
+		t.Errorf("task repository url = %q, want https://github.com/owner/myrepo.git", tk.RepositoryURL)
 	}
 	if !contains(tk.Tags, "ci") || !contains(tk.Tags, "auto") {
 		t.Errorf("task tags %v missing expected ci/auto tags", tk.Tags)
@@ -375,8 +375,8 @@ func TestGitHubWebhook_FallbackToSingleProject(t *testing.T) {
 	if err != nil {
 		t.Fatalf("task not found: %v", err)
 	}
-	if tk.Agent.ProjectDir != "/workspace/someapp" {
-		t.Errorf("expected fallback to /workspace/someapp, got %q", tk.Agent.ProjectDir)
+	if tk.RepositoryURL != "https://github.com/owner/myrepo.git" {
+		t.Errorf("expected fallback repository url, got %q", tk.RepositoryURL)
 	}
 }