Slice 1: build green, MVP core flow

- New agentlib module (gitutil + deployer with NewGo / NewPHP) replaces
  agent-micro/internal so both agents can share it (Go's internal/ rule
  was blocking agent-gateway from importing agent-micro's packages).
- Migrate agents from legacy github.com/docker/docker/client to the
  current github.com/moby/moby/client v0.5.0 / moby/moby/api v1.55.0.
- Fix compile errors in the original committed code: missing
  gorilla/websocket import in control-plane/internal/ws/handlers.go,
  unaliased dockerclient reference, wrong SQLite driver name
  (sqlite3 -> sqlite), Dialer.Dial 3-return-value mismatch.
- scripts/build.sh: Go 1.23 -> 1.24, apk add git, safe.directory for
  bind-mounted host tree, chmod inside container (host can't chmod
  files owned by container root).
- README and REQUIREMENTS updated to reflect the actual architecture
  (Go + SQLite, no Spring Boot, moby SDK, per-deploy no image build)
  with a per-feature status checklist at the end of REQUIREMENTS.

scripts/build.sh

@@ -15,7 +15,7 @@ REPO_ROOT="$(pwd)"
 OUT="$REPO_ROOT/bin"
 mkdir -p "$OUT"
 
-GO_IMAGE="${GO_IMAGE:-golang:1.23-alpine}"
+GO_IMAGE="${GO_IMAGE:-golang:1.24-alpine}"
 
 # ponytail: bind-mount a persistent gocache so module downloads + build cache
 # survive across runs. Otherwise every build re-downloads the world from
@@ -36,17 +36,26 @@ docker run --rm \
   "$GO_IMAGE" \
   sh -c '
     set -e
+    # git is needed for module resolution: some deps (and go.work.sum)
+    # may pull from VCS. alpine ships without it.
+    apk add --no-cache git >/dev/null
+    # The container runs as root and /src is bind-mounted from the host;
+    # git refuses to operate on a tree it does not own ("dubious ownership").
+    # We never commit inside the container — the host owns the working tree —
+    # so disabling the check is safe.
+    git config --global --add safe.directory /src
     # -trimpath: strip absolute paths from the binary (reproducible builds).
     # -ldflags="-s -w": drop symbol table + DWARF, smaller binary.
     go build -trimpath -ldflags="-s -w" -o /out/control-plane  ./control-plane/cmd/control-plane
     go build -trimpath -ldflags="-s -w" -o /out/agent-micro    ./agent-micro/cmd/agent-micro
     go build -trimpath -ldflags="-s -w" -o /out/agent-gateway  ./agent-gateway/cmd/agent-gateway
+    # go build does not set +x; do it here while we still own the files.
+    chmod +x /out/control-plane /out/agent-micro /out/agent-gateway
   '
 
 echo
 echo "==> binaries:"
 ls -lh "$OUT"
-chmod +x "$OUT"/*
 
 # Verify the binaries are actually linux/amd64. ponytail: catches a mistake
 # where someone removes the GOOS/GOARCH env and ships a darwin binary to