Merge commit 'refs/phase3/pre-ajax/publication-tip' into integration/pre-ajax-release

# Conflicts:
#	routes/chat_routes.py
#	routes/session_routes.py
#	src/agent_loop.py
#	src/agent_tools/filesystem_tools.py
#	src/teacher_escalation.py
#	src/tool_capabilities.py
#	src/tool_execution.py
#	tests/test_mcp_add_server_args_validation.py
#	tests/test_token_cache_atomic_swap.py

docker/host-network.yml

@@ -0,0 +1,21 @@
+# High-trust host network access. Enable only when the Odysseus agent needs
+# host-native LAN/VPN/mDNS behavior that Docker bridge networking cannot
+# provide. Linux only; Docker Desktop does not provide equivalent host
+# networking semantics.
+#   COMPOSE_FILE=docker-compose.yml:docker/host-workspace.yml:docker/host-network.yml
+#   APP_PORT=7011
+services:
+  odysseus:
+    network_mode: host
+    ports: !reset []
+    environment:
+      - APP_PORT=${APP_PORT:-7011}
+      - APP_BIND=${APP_BIND:-0.0.0.0}
+      - SEARXNG_INSTANCE=${ODYSSEUS_HOST_NETWORK_SEARXNG_INSTANCE:-http://127.0.0.1:8080}
+      - CHROMADB_HOST=${ODYSSEUS_HOST_NETWORK_CHROMADB_HOST:-127.0.0.1}
+      - CHROMADB_PORT=${ODYSSEUS_HOST_NETWORK_CHROMADB_PORT:-8100}
+      - ODYSSEUS_CONTAINER_NETWORK_MODE=host
+    command:
+      - sh
+      - -c
+      - exec uvicorn app:app --host "$${APP_BIND:-0.0.0.0}" --port "$${APP_PORT:-7011}"

docker/host-workspace.yml

@@ -0,0 +1,11 @@
+# High-trust host workspace access. Enable only when the Odysseus agent should
+# work on a host directory outside the container's normal /app/data sandbox.
+#   COMPOSE_FILE=docker-compose.yml:docker/host-workspace.yml
+#   ODYSSEUS_HOST_WORKSPACE_DIR=/absolute/host/path
+#   ODYSSEUS_HOST_WORKSPACE_MOUNT=/host/workspace
+services:
+  odysseus:
+    volumes:
+      - ${ODYSSEUS_HOST_WORKSPACE_DIR:?set ODYSSEUS_HOST_WORKSPACE_DIR}:${ODYSSEUS_HOST_WORKSPACE_MOUNT:-/host/workspace}:rw,z
+    environment:
+      - ODYSSEUS_HOST_WORKSPACE_MOUNT=${ODYSSEUS_HOST_WORKSPACE_MOUNT:-/host/workspace}