fix(container): remove npm from agent runtime

[Cvv9]

Summary

• remove npm/npx and their dependency tree after installing the pinned Codex ACP adapter
• retain Node, Git, Buzz, and Codex ACP runtime commands
• assert package-manager absence in the hosted-agent smoke job

Security evidence

• Docker Scout on the candidate runtime: 0 critical, 0 high, 0 medium, 0 low
• The previous candidate exposed CVE-2026-59873 in npm's bundled tar package

Follow-up to #51 and VarVik-Studios/varvik-suite#10.

[Cvv9]

CI disposition: Docker image run 31687921847 is fully green, including the hosted-agent build/smoke. General CI run 31687921766 failed only in untouched Desktop Smoke E2E shard 4. Initial run: virtualization.spec.ts test 08 failed (238 passed). One targeted failed-job rerun produced the same virtualization failure (236 passed; relay-reconnect and spoiler were reported flaky and recovered). No desktop files are changed by this PR. Proceeding only through normal branch policy; no admin bypass.