feat(ql3): harden copilot mcp host deployment

deploy/mcp/ql3-cluster-copilot/docker-stdio.sh

@@ -0,0 +1,83 @@
+#!/bin/sh
+
+set -eu
+
+usage() {
+  printf '%s\n' 'Usage: docker-stdio.sh check|serve' >&2
+  exit 64
+}
+
+fail() {
+  printf '%s\n' '{"schemaVersion":1,"component":"qinglong3-cluster-copilot-mcp-launcher","event":"launch_failed"}' >&2
+  exit 78
+}
+
+[ "$#" -eq 1 ] || usage
+mode=$1
+case "$mode" in
+  check|serve) ;;
+  *) usage ;;
+esac
+
+image=${QL3_COPILOT_MCP_IMAGE-}
+private_root=${QL3_COPILOT_MCP_PRIVATE_ROOT-}
+network=${QL3_COPILOT_MCP_NETWORK-}
+resource_class=${QL3_COPILOT_MCP_RESOURCE_CLASS-compact}
+
+printf '%s' "$image" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9._/-]{0,191}@sha256:[0-9a-f]{64}$' || fail
+printf '%s' "$network" | grep -Eq '^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$' || fail
+case "$network" in
+  bridge|default|host|none) fail ;;
+esac
+case "$private_root" in
+  /*) ;;
+  *) fail ;;
+esac
+case "$private_root" in
+  *','*|*':'*) fail ;;
+esac
+[ -d "$private_root" ] || fail
+canonical_root=$(CDPATH= cd -- "$private_root" 2>/dev/null && pwd -P) || fail
+[ "$canonical_root" = "$private_root" ] || fail
+
+case "$resource_class" in
+  compact)
+    memory=192m
+    cpus=0.25
+    pids=32
+    concurrency_ceiling=1
+    ;;
+  standard)
+    memory=512m
+    cpus=1
+    pids=64
+    concurrency_ceiling=4
+    ;;
+  dense)
+    memory=1g
+    cpus=2
+    pids=96
+    concurrency_ceiling=16
+    ;;
+  *) fail ;;
+esac
+
+set -- docker run --rm -i --pull never --init --read-only \
+  --network "$network" \
+  --cap-drop ALL \
+  --security-opt no-new-privileges \
+  --user 10001:10001 \
+  --pids-limit "$pids" \
+  --memory "$memory" \
+  --cpus "$cpus" \
+  --mount "type=bind,src=$private_root,dst=/var/run/secrets/qinglong3/copilot-mcp,readonly" \
+  "$image" \
+  copilot-mcp
+
+if [ "$mode" = check ]; then
+  exec "$@" --check --config /var/run/secrets/qinglong3/copilot-mcp/mcp.json \
+    "--concurrency-ceiling=$concurrency_ceiling"
+fi
+
+exec "$@" --config /var/run/secrets/qinglong3/copilot-mcp/mcp.json \
+  "--concurrency-ceiling=$concurrency_ceiling"