chore(image): drop sidecar/Playwright legacy + plug NO_PROXY hole

Dockerfile carried forward three pieces of dead state from the
pre-migration era:

- ``/app/runtime`` and ``/app/tools`` mkdir entries — the FastAPI
  sidecar + in-container tool registry that those dirs hosted are
  gone.
- ``/home/pentester/{configs,wordlists,output,scripts}`` — empty
  placeholders never populated by anything; greps for them in the
  whole repo come back empty.
- ~20 explicit Chrome/Playwright runtime libs (``libnss3``,
  ``libnspr4``, ``libatk*``, ``libxcomposite1``, …) plus emoji /
  freefont packages. These were Playwright deps; the migration to
  ``agent-browser`` runs ``agent-browser install --with-deps`` which
  owns this list authoritatively. Keep ``libnss3-tools`` for
  ``certutil`` in the entrypoint's CA-trust step.

Drive-by bug fix: ``NO_PROXY=localhost,127.0.0.1`` was set in the
entrypoint (``/etc/profile.d/proxy.sh`` + ``/etc/environment``) but
NOT in the SDK manifest's environment. ``docker exec``-spawned
processes (which ``session.exec`` and the Shell capability use)
inherit only manifest env, so ``agent-browser``'s CDP-localhost
traffic was being looped back through Caido. Add it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

strix/runtime/session_manager.py

@@ -68,7 +68,9 @@ async def create_or_reuse(
 
     # Caido runs as an in-container sidecar; HTTP(S) traffic from any
     # process started via ``session.exec`` (the SDK's Shell tool, etc.)
-    # picks up these env vars automatically.
+    # picks up these env vars automatically. ``NO_PROXY`` keeps the
+    # agent-browser CDP daemon's localhost traffic from looping back
+    # through Caido.
     container_caido_url = f"http://127.0.0.1:{_CONTAINER_CAIDO_PORT}"
     manifest = Manifest(
         entries={"sources": LocalDir(src=sources_path)},
@@ -79,6 +81,7 @@ async def create_or_reuse(
                 "http_proxy": container_caido_url,
                 "https_proxy": container_caido_url,
                 "ALL_PROXY": container_caido_url,
+                "NO_PROXY": "localhost,127.0.0.1",
             },
         ),
     )