Add bbox run-image ephemeral one-shot command (#207)

* Add bbox run-image ephemeral one-shot command

Implements #205: `bbox run-image IMAGE [flags] -- CMD` boots an
arbitrary OCI image once, without editing config or registering an
agent. Builds an in-memory agent.Agent from flags via the existing
config.AgentFromOverride path (#200) and runs it through the normal
SandboxRunner — no config-file mutation, no registry persistence.

Ephemeral defaults (safer-than-custom): credential persistence off,
settings import off, env forwarding empty, MCP off, git token / SSH
agent forwarding off. Egress defaults to permissive with a stderr
disclosure so the bare example boots; tighten with
--egress-profile/--allow-host. --mcp forces mcp.mode=env and
inherits the safe-tools custom-agent authz default.

Reuses run() by extracting a shared runSandbox(...) tail. The
in-memory agent is registered data-only (nil Plugin) so
isCustomAgent/applyCustomAgentAuthzDefault apply the safe-tools
default. Name derives from the image repo basename when --name is
unset.

docs/run-image.md documents the minimum image contract (shell at
/bin/sh, command on PATH, CA bundle, sandbox user UID 1000) and
the ephemeral defaults.

* Fix run-image egress allow-host and MCP flag UX

Fold --allow-host into the run-image agent override so the
ValidateCustomAgent gate sees hosts for a non-permissive egress
profile. Previously --allow-host flowed only into RunOpts.AllowHosts
(applied at VM start), so the load-time validation rejected
--egress-profile standard/locked unless --mcp was also set, breaking
the documented example. Hosts are parsed via egress.ParseHostFlag and
filed under override.EgressHosts[profile]; runFlags.allowHosts is
cleared to avoid filing them twice.

Warn when MCP sub-flags (--mcp-authz-profile, --mcp-group, --mcp-port,
--mcp-config, --mcp-session-ttl) are set without --mcp, which is off by
default for run-image. They were silently dropped, misleading the
operator into thinking they tightened tool access.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Jakub Hrozek <jakub@stacklok.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

README.md

@@ -154,6 +154,16 @@ bbox claude-code -- --help
 
 # List available agents
 bbox list
+
+# Run an arbitrary OCI image as an ephemeral one-shot (no persistence, no config)
+bbox run-image ghcr.io/jbarslox/aider-bbox:latest -- aider
+
+# Ephemeral run with restricted egress and a single forwarded env var
+bbox run-image ubuntu:24.04 \
+  --env OPENAI_API_KEY \
+  --egress-profile standard \
+  --allow-host api.openai.com:443 \
+  -- python -m http.server
 ```
 
 ### Workspace modes
@@ -300,6 +310,19 @@ agents:
       - MY_AGENT_*
 ```
 
+### Bring-your-own image: `run-image`
+
+For a one-off image you don't want to declare in config, use `run-image`. It
+builds an in-memory agent from CLI flags with safer-than-custom defaults
+(credential persistence off, host settings import off, env forwarding empty,
+git token / SSH agent off, MCP off, egress permissive) and runs it through the
+same sandbox path. See [docs/run-image.md](docs/run-image.md) for the minimum
+image contract and the full flag set.
+
+```bash
+bbox run-image ghcr.io/jbarslox/aider-bbox:latest -- aider
+```
+
 ## How It Works
 
 ```