Merge commit 'refs/phase3/pre-ajax/publication-tip' into integration/pre-ajax-release

# Conflicts:
#	routes/chat_routes.py
#	routes/session_routes.py
#	src/agent_loop.py
#	src/agent_tools/filesystem_tools.py
#	src/teacher_escalation.py
#	src/tool_capabilities.py
#	src/tool_execution.py
#	tests/test_mcp_add_server_args_validation.py
#	tests/test_token_cache_atomic_swap.py

tests/test_docker_devops_hardening.py

@@ -23,6 +23,8 @@ COMPOSE_FILES = [
     ROOT / "docker-compose.gpu-amd.yml",
 ]
 HOST_DOCKER_OVERLAY = ROOT / "docker" / "host-docker.yml"
+HOST_WORKSPACE_OVERLAY = ROOT / "docker" / "host-workspace.yml"
+HOST_NETWORK_OVERLAY = ROOT / "docker" / "host-network.yml"
 TEST_DOCS = [
     ROOT / "tests" / "README.md",
     ROOT / "tests" / "TESTING_STANDARD.md",
@@ -71,6 +73,16 @@ def test_default_compose_files_do_not_mount_host_docker_socket():
         assert "/var/run/docker.sock" not in text, path.name
 
 
+def test_browser_image_includes_multilingual_font_support():
+    dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
+
+    # Headless Chromium must be able to render user/generated CJK text. A
+    # generic sans-serif declaration cannot help when the image has no glyph
+    # provider at all.
+    assert "fonts-noto-cjk" in dockerfile
+    assert "fontconfig" in dockerfile
+
+
 def test_host_docker_overlay_mounts_socket_and_adds_docker_group():
     overlay = yaml.safe_load(HOST_DOCKER_OVERLAY.read_text(encoding="utf-8"))
     service = overlay["services"]["odysseus"]
@@ -80,6 +92,32 @@ def test_host_docker_overlay_mounts_socket_and_adds_docker_group():
     assert "ODYSSEUS_ENABLE_HOST_DOCKER=true" in service["environment"]
 
 
+def test_host_workspace_overlay_mounts_explicit_host_workspace():
+    overlay = yaml.safe_load(HOST_WORKSPACE_OVERLAY.read_text(encoding="utf-8"))
+    service = overlay["services"]["odysseus"]
+
+    assert (
+        "${ODYSSEUS_HOST_WORKSPACE_DIR:?set ODYSSEUS_HOST_WORKSPACE_DIR}:${ODYSSEUS_HOST_WORKSPACE_MOUNT:-/host/workspace}:rw,z"
+        in service["volumes"]
+    )
+    assert (
+        "ODYSSEUS_HOST_WORKSPACE_MOUNT=${ODYSSEUS_HOST_WORKSPACE_MOUNT:-/host/workspace}"
+        in service["environment"]
+    )
+
+
+def test_host_network_overlay_uses_host_namespace_without_port_mapping():
+    text = HOST_NETWORK_OVERLAY.read_text(encoding="utf-8")
+
+    assert "network_mode: host" in text
+    assert "ports: !reset []" in text
+    assert "SEARXNG_INSTANCE=${ODYSSEUS_HOST_NETWORK_SEARXNG_INSTANCE:-http://127.0.0.1:8080}" in text
+    assert "CHROMADB_HOST=${ODYSSEUS_HOST_NETWORK_CHROMADB_HOST:-127.0.0.1}" in text
+    assert "CHROMADB_PORT=${ODYSSEUS_HOST_NETWORK_CHROMADB_PORT:-8100}" in text
+    assert "ODYSSEUS_CONTAINER_NETWORK_MODE=host" in text
+    assert '--port "$${APP_PORT:-7011}"' in text
+
+
 def test_docker_entrypoint_gates_socket_group_plumbing_on_explicit_opt_in():
     script = (ROOT / "docker" / "entrypoint.sh").read_text(encoding="utf-8")
     block_start = script.index("DOCKER_SOCK=\"${DOCKER_SOCK:-/var/run/docker.sock}\"")