Issue #569: the behavioral eval suite (`./evals/run-evals.sh`) runs
against the operator's live `netclawd` and mutates its state — seeding
test documents into the production SQLite DB, accumulating LLM-formed
memories across runs, and destroying real user memories when eval
iterations reset. The inverse contamination is just as bad: operator
memories crowd out seeded eval docs for recall slots, dropping memory
eval scores from 100% → 30% by the third sequential run.

This change runs `netclawd` inside an ephemeral Docker container per
eval suite invocation. Two-way contamination disappears, and the same
image becomes the supported Docker-deployment artifact for netclawd
itself.

## Scope

- `docker/Dockerfile` — release-grade ubuntu:24.04 image with
  pre-installed autonomous-agent tools (git, jq, sqlite3, python3, gh)
  and both `netclaw` + `netclawd` binaries on PATH. ENTRYPOINT is the
  daemon; operators supply config via `NETCLAW_*` env vars and optional
  volume mounts on `/root/.netclaw`.
- `scripts/docker/build-image.sh` — single build entrypoint reused by
  contributors, PR validation, and the release publish job. Supports
  `IMAGE_REPO` override, `NO_BUILD=1` escape hatch, and fails loudly if
  the published binaries are missing.
- `.github/workflows/pr_validation.yml` — new `validate-docker-build`
  job that runs the shared build script on every PR and verifies the
  image reaches `/api/health/ready=healthy` within 60s using an ollama
  stub provider (no secrets required).
- `.github/workflows/publish_release_binaries.yml` — new `publish-docker`
  job pushes `ghcr.io/aaronontheweb/netclawd:{latest,v${version},v${major}.${minor}}`
  on every release tag, using the same build script.
- `evals/run-evals.sh` — rewrite of bootstrap, daemon lifecycle, and log
  capture. The script spawns `docker run -d --rm --network host` with a
  throwaway `$EVAL_HOME` identity copy and forwards provider/model
  config via env vars. Required eval-target credentials (provider type,
  endpoint, model id) are always explicit: env vars in non-interactive
  contexts, stdin prompts on terminals, and a hard-fail otherwise.
  Assertion helpers and the 22 case bodies are untouched.
- `src/Netclaw.Configuration/NetclawPaths.cs` — honour `NETCLAW_HOME`
  env var as a fallback source for `BasePath` (precedence: explicit arg
  → env var → default). Enables CLI-side path isolation during eval
  runs so `netclaw -p` can't leak state into the host's real
  `~/.netclaw/`.
- `evals/README.md` — document the new env-var surface and remove the
  "local instance only — no isolation" limitation.

## Known gap / deferred

The daemon does NOT fail fast on empty config today — missing provider
config falls back to a default `local-ollama` provider, and missing
identity files are silently tolerated by `FileSystemPromptProvider`.
The design doc and the daemon-container spec deliberately reflect
reality rather than aspiration; making the daemon fail loudly on empty
config is a separate follow-up.

Also deferred (follow-up issues): Docker Hub publishing alongside GHCR
(#602), compaction eval cases using `NETCLAW_EVAL_CONTEXT_WINDOW`, CI
eval execution against a remote LLM, committed identity fixture under
`evals/fixtures/` for headless CI, drain-wait between memory-formation
and recall eval phases (#437, already open).

## OpenSpec change

Drives through `openspec/changes/containerize-daemon-and-evals/`
(proposal, design, specs/daemon-container, specs/netclaw-cli delta,
tasks). New capability `daemon-container`; modified capability
`netclaw-cli` adds one requirement for `NETCLAW_HOME` env var
precedence. Sync + archive will happen in a follow-up commit after
merge, matching the pattern established by 325f856.

## Verification

- `dotnet test src/Netclaw.Configuration.Tests` → 152 pass (7 new
  NetclawPaths env var precedence tests)
- `dotnet test src/Netclaw.Cli.Tests` → 413 pass
- `dotnet test src/Netclaw.Daemon.Tests` → 428 pass
- `dotnet slopwatch analyze --hook` → no new violations vs baseline
- `scripts/docker/build-image.sh dev` → produces
  `ghcr.io/aaronontheweb/netclawd:dev` successfully
- Manual bootstrap smoke test: the eval script's
  `check_prerequisites` + `start_eval_daemon` + `cleanup_eval_env`
  path runs cleanly against a fixture identity directory, with the
  daemon reaching healthy state and `force_rmrf` handling the
  root-owned files the container writes into the bind-mounted logs
  directory.

Full-suite verification against a real LLM endpoint is deferred to PR
review; the bootstrap smoke test validates everything that doesn't
require LLM round-trips.

## PR follow-up actions

- First GHCR push will create a private package
  (`ghcr.io/aaronontheweb/netclawd`). Flip visibility to public under
  GitHub → Packages → Settings before external users can pull
  without `docker login`.
- After merge, commit `chore(openspec): sync and archive
  containerize-daemon-and-evals` to move the delta specs into the
  canonical specs tree and archive the change directory.

Closes #569.

The previous simplification pass trimmed the Dockerfile's apt packages
based on what the current eval suite exercises, but the image's primary
purpose is general-purpose netclawd deployment, not evals. An
autonomous agent should have the common shell toolkit pre-installed so
it can reach for things without needing to `apt-get install` first on
every new action.

Restore: wget, jq, sqlite3, python3-pip, python3-venv.

The `apt-get install` escape hatch the Ubuntu base provides is for
tools the agent discovers it needs on demand, not for things it should
always have.

Verified: image still builds, starts healthy in 4s, and all 8
pre-installed tools resolve on PATH inside the container.