feat: runner container + broker deploy pipeline

- apps/runner/: Dockerfile (node22 + python3 + uv + bun) + supervisor.mjs
  (HTTP API for load/call/unload/health)
- docker-compose: runner service with shared services-data volume
- Broker mcp_deploy: git clone or zip extract → runner /load → MCP spawn
- Broker mcp_call: routes managed services to runner via HTTP, falls back
  to live-proxy for peer-hosted servers
- RUNNER_URL env var for broker → runner communication

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.production.yml

@@ -83,6 +83,25 @@ services:
       start_period: 30s
       retries: 3
 
+  runner:
+    build:
+      context: ./apps/runner
+    restart: always
+    environment:
+      RUNNER_PORT: 7901
+    volumes:
+      - services-data:/var/claudemesh/services
+    expose:
+      - "7901"
+    networks:
+      - claudemesh-internal
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://localhost:7901/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 10s
+      retries: 3
+
   broker:
     image: ${BROKER_IMAGE:-claudemesh-broker:latest}
     restart: always
@@ -103,6 +122,11 @@ services:
       NEO4J_URL: bolt://neo4j:7687
       NEO4J_USER: neo4j
       NEO4J_PASSWORD: ${NEO4J_PASSWORD:-changeme}
+      RUNNER_URL: http://runner:7901
+      CLAUDEMESH_SERVICES_DIR: /var/claudemesh/services
+      BROKER_ENCRYPTION_KEY: ${BROKER_ENCRYPTION_KEY:-}
+    volumes:
+      - services-data:/var/claudemesh/services
     expose:
       - "7900"
     networks:
@@ -115,6 +139,8 @@ services:
         condition: service_healthy
       neo4j:
         condition: service_healthy
+      runner:
+        condition: service_healthy
     healthcheck:
       test: ["CMD", "bun", "-e", "fetch('http://localhost:7900/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"]
       interval: 15s
@@ -159,6 +185,7 @@ volumes:
   minio-data:
   qdrant-data:
   neo4j-data:
+  services-data:
 
 networks:
   # Coolify's shared Traefik network — must already exist on the host