Separate host-private and root-trusted state from writable container workspace mounts

[kcosr]

Problem

AW Gateway currently places control-plane state beneath workspace.state_dir, which is mounted read-write into the container.

This is confirmed in both Apple Container and Linux/Podman deployments. The container session user can access files including:

• The inner SSH private key and authorized_keys
• The agent control token
• Bootstrap and agent configuration
• SSH environment and transfer-policy configuration
• Session metadata and service logs

In the Linux deployment, aw-ssh-command-filter rereads the user-writable transfer policy for every SSH command. The container user can therefore relax configured SFTP and SCP restrictions. Root services also write logs beneath a user-owned directory.

Host lifecycle locks, the identity token, host firewall configuration, and read-only proxy configuration are not directly exposed by this issue.

Desired outcome

Separate state according to its trust requirements:

• Keep private keys, tokens, endpoint metadata, and authoritative policy host-only.
• Mount required generated configuration read-only or copy it into root-owned container storage.
• Store root service runtime data and logs in root-owned storage.
• Keep only user workspace and application data writable by the session user.
• Add coverage for Apple Container, Docker, and Podman proving that session users cannot read host credentials or modify root-trusted policy.

Existing deployments using the default workspace layout should remain compatible during this change.