refactor(mcpg): type container runtime arguments and mounts

[Copilot]

Summary

Replace positional Docker mount and argument strings with typed MCPG runtime configuration while preserving the existing serialized JSON contract.

• Typed runtime model

  • Adds typed mounts, network modes, host mappings, users, and container hardening options.
  • Rejects malformed mounts, host networking, duplicate destinations, and conflicting singleton settings.

• Compiler integration

  • Migrates Azure DevOps MCP, SafeOutputs, and user MCP generation.
  • Preserves argument ordering and least-privilege security invariants.

ContainerRuntimeConfig::builder()
    .network(Network::None)
    .user(ContainerUser::new("${MCP_RUNNER_UID}:${MCP_RUNNER_GID}")?)
    .read_only()
    .build()?

Test plan

• Run cargo test.
• Run cargo clippy --all-targets --all-features.
• Verify exact serialized mounts and runtime arguments for ADO MCP, SafeOutputs, and user MCPs.

• Fixes refactor(mcpg): type container runtime arguments and mounts #1835

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

✅ PR Security Reviewer completed the security review.

[github-actions]

✅ Rust Code Quality Reviewer completed the Rust code quality review.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

[github-actions]

⚠️ Test Quality Sentinel failed during the test quality analysis.

[github-actions]

⚠️ Compiler Contract Reviewer failed during the compiler contract review.

[github-actions]

Security review: no regressions found

This PR replaces positional mount/arg strings with a typed ContainerRuntimeConfig builder for MCPG stdio servers. Reviewed for injection into generated pipelines, weakened validation, token scope, and network boundary changes.

Findings:

• Existing pre-build validation (validate_mount_source, validate_docker_args, validate_container_image, warn_potential_secrets in validate_stdio_mcp) is still called unchanged before the typed runtime is constructed — no validation was removed or bypassed.
• Serialized mounts/args field order and content is preserved for both compiler-owned configs (SafeOutputs, Azure DevOps MCP) and user-authored MCP mounts/args, confirmed by the diff's own regression tests (test_generate_mcpg_config_preserves_user_runtime_arrays, serializes_mounts_and_runtime_args_in_mcpg_order).
• Network::named explicitly rejects "host" networking, matching the prior implicit invariant, and the new code adds duplicate-mount-destination and host-mapping-conflict checks that did not exist before (net hardening, not regression).
• No new token/credential values are introduced or plumbed differently; SYSTEM_ACCESSTOKEN / ado_bundle.rs chokepoint is untouched by this diff.
• User-supplied raw args (opts.args) still flow through as extra_args exactly as before, so no new elevation path for user-controlled MCP configuration is introduced.

This is a security-neutral refactor overall, with a few incidental hardening improvements (conflict detection, structured mount validation). No blocking issues.

🔒 Security review by PR Security Reviewer · auto · 32.2 AIC · ⌖ 4.75 AIC · ⊞ 11.3K
_{Comment /review to run again}

[github-actions]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

Solid refactor: the typed builder is well-tested (conflicting mounts/singletons/host-networking), preserves the exact serialized mounts/args shape via #[serde(flatten)], and error paths use anyhow::Context properly with actionable messages. No merge-blocking defects found.

Themes

• One advisory finding posted inline: the typed/raw conflict guard (reject_typed_raw_conflict) only covers network, user, pids-limit, and working-directory — boolean/collection settings like --tmpfs, --cap-drop, --read-only, --security-opt have no equivalent raw-arg conflict check.
• rust-critic sub-agent did not return usable output in time; review is based on my own pass only.

🦀 Rust code quality review by Rust Code Quality Reviewer · auto · 59.2 AIC · ⊞ 11.1K
_{Comment /review to run again}

Comments that could not be inline-anchored

src/compile/extensions/container_runtime.rs:687

Typed/raw conflict detection covers only network, user, pids-limit, and working-directory — --read-only, --cap-drop, --tmpfs, and --security-opt set via typed builder methods aren't checked against the same flags in extra_args, so a duplicate/contradictory raw arg (e.g. a different --tmpfs destination+options pair passed through extra_args while .tmpfs(...) is also called) silently produces two conflicting flags in the rendered docker run args instead of failing fast like the …