add-ollama-provider

# Add Ollama Provider Routes an agent group to a local Ollama instance instead of the Anthropic API. See `docs/ollama.md` for how this works and the tradeoffs involved. ## Prerequisites 1. **Ollama is installed and running** on the host — verify: `curl -s http://localhost:11434/api/tags` 2. **A model is pulled** — e.g. `ollama pull gemma4` or `ollama pull qwen3-coder` 3. **The agent group already exists** — run `/init-first-agent` first if needed ## 1. Check source support The feature requires two fields in `ContainerConfig` (`env` and `blockedHosts`) and their corresponding wiring in `container-runner.ts`. Check if already present: ```bash grep -c 'blockedHosts' src/container-config.ts src/container-runner.ts ``` If either count is 0, apply the changes in steps 1a and 1b. Otherwise skip to step 2. ### 1a. Extend ContainerConfig In `src/container-config.ts`, add to the `ContainerConfig` interface: ```typescript env?: Record<string, string>; blockedHosts?: string[]; ``` And in `readContainerConfig`, add inside the returned object: ```typescript env: raw.env, blockedHosts: raw.blockedHosts, ``` ### 1b. Wire into container-runner In `src/container-runner.ts`, after the `NANOCLAW_MCP_SERVERS` block, add: ```typescript // Per-agent-group env overrides — applied last to win over OneCLI values. if (containerConfig.env) { for (const [key, value] of Object.entries(containerConfig.env)) { args.push('-e', `${key}=${value}`); } } // Blocked hosts: resolve to 0.0.0...