init: Coder compose + templates + act-runner

coder/templates/mcp-sandbox/README.md

@@ -0,0 +1,31 @@
+# mcp-sandbox
+
+Ephemeral, minimalist Python sandbox for MCP-driven code execution (plotting, quick analysis, exfil-style external fetches with `curl`/`wget`/`httpx`).
+
+## What's baked in
+- Debian slim + uv + Python 3.13 (rebuild image to bump)
+- Sci stack: numpy, pandas, matplotlib, plotly, seaborn, scipy, scikit-learn
+- HTTP: requests, httpx, curl, wget
+- Tools: git, ssh, ipython, sudo
+- Non-root user `coder` (uid 1000) with passwordless sudo
+
+## Why "baked in" vs install-at-startup
+MCP spawns short-lived workspaces. Installing deps every time burns ~2 min and ~300 MB of network. Bake them, spin in ~3 s.
+
+## Build the image (run on CT 111)
+```bash
+cd /opt/stacks/coder/templates/mcp-sandbox
+docker build -t coder-mcp-sandbox:latest .
+# bump Python: docker build --build-arg PY_VERSION=3.14 -t coder-mcp-sandbox:latest .
+```
+
+## Push the template to Coder
+```bash
+coder templates push mcp-sandbox -d /opt/stacks/coder/templates/mcp-sandbox
+```
+
+## Ephemerality
+`$HOME` is **not** persisted. Each workspace start gets fresh state. Plots written to `~/plots/` vanish on stop — copy via `coder cp` or upload elsewhere from inside the workspace if you need to keep them.
+
+## GPU
+`/dev/dri/renderD128` is mounted. Useful if matplotlib offloads to GPU or if you decide to add `torch[cpu]` → `torch` with Arc support later.