Run the container-side python as package modules

[CrypticSwarm]

Stacked on swarmforge-package-skeleton.

The agent translator and the opencode.json merger were flat files copied into /usr/local/lib/swarmforge, sitting next to the swarmforge package they already imported. That left the image with two notions of where Swarmforge's python lives — one of them a directory whose whole purpose was "files that get COPY'd in".

Both move into the package:

• anvil/translate_agents.py → swarmforge/agents/translate.py
• anvil/merge_opencode_json.py → swarmforge/config/merge_opencode.py

The Dockerfile drops its two flat COPY lines and keeps only the package copy; the entrypoint runs python3 -P -m swarmforge.agents.translate and python3 -P -m swarmforge.config.merge_opencode with the package's parent as the import root. anvil/ is now just the Dockerfile and the entrypoint.

Both modules are otherwise untouched — the only edits inside them are the usage string and the warn() prefix, which named files that no longer exist. Nothing reads or parses either string.

Why -P

python3 -m does not resolve imports the way python3 <script> does: it puts the working directory first on sys.path, where the script form put the script's own directory. The entrypoint's working directory is /workspace, and these run as root, before privileges are dropped. Without -P, a repository that happens to carry its own swarmforge/ would shadow the image's copy and have it executed. -P suppresses that entry, which restores exactly what the script form did. The image builds CPython 3.12.7, so the flag is available.

Tests

The image-layout tests had pinned the entrypoint to literal copy destinations, which is the wrong thing to assert once the layout is a package. They now check the properties that actually have to hold, each verified to fail when its subject regresses:

• every module the entrypoint runs ships in the package,
• each names the import root the package lands in,
• none lets the working directory onto sys.path, and the pinned interpreter is new enough for the flag that guarantees it,
• the translator's [ -f ] guard covers the module its own function runs,
• both modules run correctly against a staged copy of the image layout, with the checkout off sys.path and off the working directory.

The merger gained coverage it never had here, including its --replace-mcp-entries argv — the tong MCP merge, which has no || continue behind it, so a rejected argument is a container that never starts rather than a degraded merge.

Suite goes 478 → 483, all green. The passthrough and launch-path invariant tests are untouched and pass.

Not yet verified

A real make build_opencode and a no-tongs run_opencode smoke run have not been done — the environment this was written in has no docker. Worth running both before merge.