Fix ssh/scp/sftp for containers running as a uid without passwd entry

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Dockerfile

@@ -85,7 +85,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential pkg-config libssl-dev cmake zlib1g-dev binutils-multiarch \
         chromium fonts-dejavu-core fonts-noto-color-emoji poppler-utils openmpt123 \
         openscad xvfb xauth \
-        openssh-client rsync mc \
+        openssh-client libnss-wrapper rsync mc \
     && rm -rf /var/lib/apt/lists/*
 # Language servers for diagnostics after edits (rust-analyzer/gopls/clangd can be
 # installed by agents: rustup component add rust-analyzer, go install …).
@@ -98,6 +98,10 @@ COPY --from=dockercli /docker /usr/local/bin/docker
 COPY server/ghidra /app/ghidra
 # git for agent shells: commits get the co-author trailer of the model (server.commit_trailer).
 COPY --chmod=755 docker/git-coauthor /usr/local/lib/codecraft/bin/git
+# ssh/scp/sftp also work when the container runs as a uid without passwd entry.
+COPY --chmod=755 docker/ssh-nss /usr/local/bin/ssh
+COPY --chmod=755 docker/ssh-nss /usr/local/bin/scp
+COPY --chmod=755 docker/ssh-nss /usr/local/bin/sftp
 COPY server/resources /app/resources
 # The agent's home lives on the data volume: tools it installs in user space
 # (pip --user, pipx, rustup, npm -g, downloaded binaries) survive rebuilds.