v1.12 track B.1: codecontext sidecar container + HTTP shim

New /opt/boocode/codecontext/ directory holding the codecontext sidecar
that BooCode's tool wrappers (track B.2) will talk to. No BooCode-side
changes yet — this commit lands the sidecar standalone.

- Dockerfile: multi-stage golang:1.24-alpine → alpine:3.20. Clones
  codecontext at v3.2.1 from github.com/nmakod/codecontext (cgo build for
  tree-sitter bindings), builds the shim alongside (CGO_ENABLED=0).
- shim.go: stdlib-only Go HTTP server wrapping codecontext's stdio MCP
  child. Newline-delimited JSON framing per the MCP transport spec
  (NOT LSP-style Content-Length). 8 POST /v1/* endpoints, one per MCP
  tool, plus GET /health. Child supervised via child.Wait() goroutine
  that os.Exit's on death so the container's restart: unless-stopped
  policy fires (Signal(0) on a zombie returns nil and is not a liveness
  check — discovered during kill-restart testing).
- go.mod: no third-party deps; future Go security advisories don't apply.

docker-compose service: joins boocode_net (no host port), mounts
/opt:/opt:ro (BooCode projects live at /opt/<slug>, not exclusively
under /opt/projects), healthcheck on /health.

Verified: build clean, healthcheck reports healthy ~15s after up,
multi-project queries return valid markdown, target_dir swap works on
subtree paths. Kill-restart cycle completes in ~200ms with one failed
health poll observed (no misleading "ok" during the gap). Memory: 24.6
MiB after 5 search_symbols calls, 5.6 MiB after 30 min idle — codecontext
releases the per-call graph between target_dir swaps, so the shim doesn't
hold the indexed state.

docker-compose.yml

@@ -55,6 +55,33 @@ services:
     networks:
       - boocode_net
 
+  # v1.12 Track B: codecontext sidecar. Stdio MCP server wrapped by a small
+  # HTTP shim (see ./codecontext/). No host port — reached from boocode at
+  # http://codecontext:8080 over the boocode_net bridge.
+  #
+  # Mounts /opt:/opt:ro (not just /opt/projects:ro): BooCode projects live
+  # at /opt/<slug> on the host, not exclusively under /opt/projects. The
+  # mount must cover anywhere a project.path could resolve to. Read-only
+  # because codecontext only analyzes — never writes. The model can't
+  # arbitrarily set target_dir to a sensitive subtree because the B.2
+  # wrappers validate target_dir against project.path before calling the
+  # shim, and the shim isn't reachable from outside boocode_net.
+  codecontext:
+    build:
+      context: ./codecontext
+    container_name: boocode_codecontext
+    restart: unless-stopped
+    networks:
+      - boocode_net
+    volumes:
+      - /opt:/opt:ro
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/health || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+
 volumes:
   boocode_pgdata: