agents: they never spoke, the decoder lost the disc, and both shared one state dir

Three defects, all mine, found by checking instead of assuming.

**They never exchanged a word.** SendMessage=0, ListAgents=0 across both new
sessions. PROTOCOL.md specified in detail what a message MAY and MAY NOT do and
never said how to send one or that the other agent was addressable -- they knew
that last time only because the human told them directly, and rebuilding with
fresh volumes wiped it. Policy without mechanism is prose. Now documented with
the two addresses, a worked example, and an instruction to introduce themselves
on the first iteration rather than waiting to have a question.

**The decoder lost the disc and the ISO.** They used to arrive inside the project
mount and silently stopped when /work became a clone. Silently is the word: the
disc-gated tests SELF-SKIP without SYLPHEED_DISC and report green, so a whole
test suite would have passed while measuring nothing. Both are now mounted
explicitly, the ISO at a stable path so run-canary does not depend on host
directory names.

**Both agents shared one Claude state directory.** They share the host's
~/.claude, and once both working directories became /work they resolved to the
same projects/-work/ -- two supposedly independent agents writing to one place,
which undoes the point of separate checkouts. Each now has its own volume, seeded
once from the host with credentials only, so a token refresh writes locally and
neither can corrupt the host's auth.

Also widened the pacing rule. It banned ScheduleWakeup by name; the decoder then
scheduled itself an hourly cron job -- not harmful, but the same instinct that
ended a run yesterday, through a door I had left open. Now: no self-scheduling by
any route.

Mount audit after the changes: shared and intentional are the exchange volume and
the read-only credential seed. Everything else -- repo, Claude state, cargo,
target, canary, disc, ISO -- is per agent or one-sided.

docker/decoder/entrypoint.sh

@@ -124,6 +124,24 @@ fi
 mkdir -p /exchange/files 2>/dev/null || true
 
 # ── Claude Code config ───────────────────────────────────────────────────────
+# ── Claude state: this agent's own, seeded once from the host ───────────────
+# Isolated per agent. Both working directories are /work, and Claude Code keys
+# its per-project state off the working directory -- so a SHARED ~/.claude put
+# two independent agents in the same projects/-work/ directory, which undoes the
+# point of giving them separate checkouts.
+#
+# Seeded rather than shared because credentials live in .credentials.json and a
+# token refresh must be able to write. Copying once means each agent refreshes
+# its own token and neither can corrupt the host's.
+if [ -d "$HOME/.claude.seed" ] && [ ! -s "$HOME/.claude/.credentials.json" ]; then
+  mkdir -p "$HOME/.claude"
+  cp -a "$HOME/.claude.seed/.credentials.json" "$HOME/.claude/" 2>/dev/null || true
+  for f in settings.json CLAUDE.md; do
+    [ -e "$HOME/.claude.seed/$f" ] && cp -a "$HOME/.claude.seed/$f" "$HOME/.claude/" 2>/dev/null || true
+  done
+  echo "[entrypoint] seeded ~/.claude from the host (credentials only)"
+fi
+
 # Seed ~/.claude.json from the host's read-only copy, then stamp onboarding as
 # complete. Claude Code re-runs its first-run wizard whenever
 # lastOnboardingVersion differs from the installed version — so a container with