fix: use baked kernel entry for remote Claude slots

[LJC-god]

Summary

Related to #489. Restore the baked Claude kernel entry for remote Docker slots without changing GPT or local/KVM commands.

slotContainerBody() currently reuses the local-slot command builder, which points at /usr/local/bin/kin-kernel. Remote slot images instead bake their executable wrapper at /opt/kin/kin-kernel and do not bind-mount the local kernel path.

• Use REMOTE_KERNEL_ENTRY for remote Claude Docker containers, keeping the existing gateway-worker arguments.
• Preserve remote GPT containers' sleep infinity command and Codex role label.
• Leave local bind-mounted/wrapped Claude commands and remote KVM image-default commands unchanged.
• Correct the existing remote-Claude assertion and add default/explicit Docker, local/wrapped, KVM, and command-to-image-payload regression coverage.

Verification

Pinned upstream base: fd9138f296bebb3336f4478367aca177559a1562.

• The same focused test files on the unmodified production source: 3 fail / 21 pass. Failures identify both remote-Claude command mismatches and the missing executable entry in the generated image payload.
• After the fix, unchanged test bytes: 24/24 pass.
• Related backend regression: 137/137 pass across 16 files, covering remote slots, cluster placement, local lifecycle, KVM, slot engine/exec/recovery, Docker memory, Codex slots, remote filesystem/egress and slot identity helpers.
• Affected Biome formatting and git diff --check: pass.

Focused command:

node --test --test-force-exit --test-concurrency=1 \
  test/unit/remote-slot-gpt.test.mjs \
  test/unit/cluster-placement.test.mjs

Tests ran on Node v22.23.2 in isolated network/mount namespaces: loopback only, synthetic HOME/TMPDIR/data, and /run masked so the host Docker socket is unavailable. Image-payload checks use synthetic ELF headers, not executable kernel binaries.

Limits

This validates generated container commands and their alignment with generated image payloads, not a real SSH-node/container/KVM/account boot. Full repository/backend/Go/web/ARM64 CI was not run locally. No production deployment or existing-container migration is included; this changes commands for newly created/recreated containers, not existing container configuration. An existing container with the old command can still match the unchanged image/layout labels and therefore needs explicit recreation; this PR does not force that migration. Integration CI and maintainer review remain required.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T01:15:18.952985Z	885158b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[hhhhhhh678]

效率牛逼