Ship a container image for running Loom/Orbit with full permissions in a disposable environment

## Ask

> "Could be a nice addition to propose a docker image configured to run orbit
> with full permissions in a sandboxed environment."

The motivation is the trade-off testers keep running into: to let the agent work
without constant approval prompts you have to turn on "dangerously bypass
permissions" on your real machine (#233), and the sandbox work that would make
that safe (#76) is a per-tool-call containment layer we haven't built. A
disposable container sidesteps both -- if the whole environment is throwaway,
full permissions inside it are a reasonable default rather than a scary toggle.

## What would need working out

- **Which surface ships.** `loom` (the CLI brain) containerizes cleanly. Orbit is
an Electron GUI, so a container has to either forward a display (X11/Wayland,
and WSLg users are already in this territory) or serve the web shell instead.
The remote/web mode documented in `docs/architecture.md` and `web/REMOTE.md`
already runs as `docker run` with an env-var credential contract -- but it's
deliberately *restricted* (bash blocked, writes confined to `notebook.md`),
which is the opposite of what this asks for. A full-permissions image is a
third configuration, not a flag on that one.
- **Getting data in and out.** Bind-mounting the analysis directory is the
obvious answer; that also decides what "disposable" really covers.
- **Credentials.** LLM keys and Galaxy credentials have to reach the container
without ending up baked into an image layer or a shell history.
- **What's inside.** Loom drives conda/local tools; a useful image needs a
toolchain baseline, which drives size and maintenance.
- **Publishing.** A Dockerfile in-repo is one commitment; a published, tagged,
updated image is a much bigger one.

Related: #76 (per-session sandbox), #233 (progressive permissions, yolo-vs-sandbox
documentation), #97/#98 (Pulsar-based local execution).

Read docs/architecture.md and web/REMOTE.md first, then compare the existing restricted Docker web mode with the Loom CLI and Orbit surfaces. Resolve whether the deliverable is an in-repository Dockerfile or a published image, including mounts, credential handling, toolchain contents, and GUI or web access. Done means the surface, scope, and acceptance criteria are agreed.

Written by the indexing model from the issue text.