fix(rtk): init the hook without /mnt/claude in ralphex-fe; close stdin at all rtk init sites

[gatezh]

What

Makes the rtk rewrite hook initialize in ralphex-fe even without the host ~/.claude mount, and adds < /dev/null to all three rtk init call sites.

Why

• ralphex-fe: rtk is never initialized when the container runs without /mnt/claude #128: in ralphex-fe/init-docker.sh the rtk init sat inside if [ -d /mnt/claude ]. A standalone container, with no host mount, never got a PreToolUse hook, and nothing reported it. rtk was installed but did nothing.
• Harden the three rtk init call sites with < /dev/null #130: the only defenses against rtk's telemetry prompt blocking on stdin were RTK_TELEMETRY_DISABLED=1 and a timeout 10 that kills the hang. Since every call site ends in || true, a timeout would leave rtk unconfigured with no signal. Closing stdin prevents the hang in the first place.

Changes

• ralphex-fe/init-docker.sh:
  • mkdir -p /home/app/.claude plus a non-recursive chown app:app on that directory, and the rtk init, now always run.
  • The copying from /mnt/claude, the Playwright MCP patch and the recursive chown -R stay inside the guard, where they were.
  • Local additions are marked with Local: … (#128) banners, set apart from the body copied from upstream.
• .devcontainer/init-plugins.sh, claude-code/.devcontainer/init-plugins.sh, ralphex-fe/init-docker.sh: rtk init … < /dev/null, keeping both RTK_TELEMETRY_DISABLED=1 and timeout 10. The rationale comments are trimmed to three lines.

Notes

• Why the unconditional chown is non-recursive: a chown -R outside the guard would also rewrite the owner of anything bind-mounted into ~/.claude, e.g. a host .credentials.json, which newer ralphex wrappers mount. That was the branch's second version and was caught in review; the third commit narrows it. rtk runs as app via gosu, so the files it creates are app-owned without it.
• Verification used the real init.sh → /srv/init.sh entrypoint path, run in claude-code:latest (dash, rtk 0.49.0 = ralphex-fe's pin) with an app user and a gosu shim:
  • master script, no mount: /home/app/.claude doesn't exist (ralphex-fe: rtk is never initialized when the container runs without /mnt/claude #128 reproduced)
  • fix, no mount: settings.json has the PreToolUse hook rtk hook claude, and everything is app:app
  • fix, with /mnt/claude:ro: the copied settings.json keeps its keys and gets the hook merged in, and the copies are app:app
  • fix, with a root-owned file bind-mounted at /home/app/.claude/.credentials.json: that file stays root:root
• Harden the three rtk init call sites with < /dev/null #130 control (docker run -t, pseudo-TTY, rtk 0.49.0):
  • With stdin open and no env var, rtk init is killed by timeout after 10.1 s (exit 124).
  • With stdin closed and no env var, it exits 0 in 0.4 s and the hook lands.
  • Re-running against a pre-filled named ~/.claude volume is idempotent and keeps existing hooks.
• shellcheck is clean on all three scripts.
• Not verified: a real docker build of ralphex-fe (the dev host's Docker disk was full), so the real gosu/dumb-init weren't exercised. CI builds and verifies both images.
• Pre-existing and out of scope:
  • Our init-docker.sh is an old snapshot of upstream, which has since changed a lot (seed_claude_home, bind-mounted credentials).
  • rtk's success banner prints to stdout on every start.
  • ralphex-fe/README.md lists RTK 0.43.0, but the Dockerfile pins 0.49.0 (also noted in docs: normalize per-image README headings and shared sections #164).
  • Track rtk-ai/rtk#3693: 'rtk init -g' can silently unregister rtk #129 (rtk init -g deletes the legacy hook script and either unregisters rtk entirely or leaves a dangling reference — both reported as "RTK hook registered (global)" rtk-ai/rtk#3693) is still open upstream and untouched.

Fixes #128
Fixes #130