Let the engine socket be somewhere other than /var/run/docker.sock

[davidmckayv]

Completes S1 of the OpenBot Desktop build: the stack proven on Podman on both macOS and Linux.

The defect

Compose mounted /var/run/docker.sock into the supervisor as a fixed source. Correct on Docker, and correct on Podman on macOS, where podman machine symlinks that path to the rootless socket inside the VM. That is why the mount needed no change there.

Wrong on rootless Podman on Linux. The path is either absent or, with podman-docker installed, a symlink to /run/podman/podman.sock — the rootful socket, which is not the one running:

/var/run/docker.sock -> /run/podman/podman.sock          # root:root, not running
/run/user/501/podman/podman.sock                          # the rootless socket, live

The supervisor is handed a dead socket, and every request for a Bot's computer fails:

The supervisor could not reach Docker (Error: Was there a typo in the url or port?).
A computer cannot be started without it.

The mount source is now ${ENGINE_SOCKET:-/var/run/docker.sock}, so nothing changes for anyone who does not set it.

Verified on Linux, red then green

Ubuntu 24.04 aarch64, rootless Podman 4.9.3, real Intelligence credentials, start.sh unmodified.

	result
before	4 pass, 1 fail — could not reach Docker
after, ENGINE_SOCKET=$XDG_RUNTIME_DIR/podman/podman.sock	5 pass, 0 fail

After: openbot-computer-risk-analyst Up 3 seconds, and the navigate test took 3.5s because it waited for the computer to be healthy rather than racing it — the fix from #372 doing its job on a second engine.

S1 is now answered on both platforms

macOS, Podman 6.1.1, applehv: 5 pass, 0 fail. Linux, Podman 4.9.3, native rootless: 5 pass, 0 fail. On both, compose came up, the supervisor held the rootless socket, it created a per-Bot computer through it, and a harness answered a live AG-UI run through the gateway with the trail recording it.

What the two platforms disagree about

Worth stating, because the build doc treats them as one row:

	macOS	Linux
Podman version	6.1.1 (brew)	4.9.3 (Ubuntu 24.04 LTS)
/var/run/docker.sock	symlink to the rootless socket, works	symlink to the rootful socket, dead
ENGINE_SOCKET needed	no	yes
SELinux	Enforcing, so label=disable required	none, AppArmor instead; label=disable is a no-op and harmless
port forwarding	gvproxy forwards the computer's published port to the host	native loopback, nothing to forward

format:check and lint clean; docker compose config valid.