feat: live deployment with automated acceptance checklist (phase 13)

- APP_INTERNAL_URL: in-network base URL for §5.2 callbacks and signed
  attachment URLs handed to the external services (compose: http://app:8787)
- work-performer image runs as the node user with ~/.claude mounted into
  /home/node — the claude CLI refuses --dangerously-skip-permissions as root
- scripts/acceptance.sh: re-run-safe live verification of the §13 checklist
  (demo import within one poll, subdivide sum=1 + editable, extend sibling,
  publish/bounty math, decline/claim/approve, changes-requested loop,
  approval award in metrics, unassign, AI job through real Claude Code with
  signed idempotent callback, breaker independence between the two services)
- README/DECISIONS: sudo HOME gotcha, internal URL, non-root performer

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker-compose.yml

@@ -27,6 +27,9 @@ services:
     env_file: .env
     environment:
       MONGO_URI: mongodb://mongo:27017
+      # in-network address handed to the external services for callbacks
+      # and signed attachment URLs (§5.2 example: http://app:8787/…)
+      APP_INTERNAL_URL: http://app:8787
     ports:
       - "127.0.0.1:${APP_PORT:-8787}:8787"
     depends_on:
@@ -69,10 +72,11 @@ services:
       PORT: "8091"
       WORK_PERFORMER_TOKEN: ${WORK_PERFORMER_TOKEN}
       PUBLIC_BASE_URL: http://work-performer:8091
-    # host Claude Code config/secrets, read-only (§9.2)
+    # host Claude Code config/secrets (§9.2); mounted into the node user's
+    # home because claude refuses --dangerously-skip-permissions as root
     volumes:
-      - ${HOME}/.claude:/root/.claude
-      - ${HOME}/.claude.json:/root/.claude.json
+      - ${HOME}/.claude:/home/node/.claude
+      - ${HOME}/.claude.json:/home/node/.claude.json
       - work-data:/work
     ports:
       - "127.0.0.1:8091:8091"