Persist Local VM workspaces across recreation

[milind-soni]

What changed

• mounts a single private OpenMausBot-owned directory at /home/cua/workspace
• treats that exact mount as part of the Local VM safety and compatibility contract
• preserves Chrome and Chromium profiles inside the durable workspace
• migrates an existing default profile on first boot and removes stale browser singleton locks
• pins the VM hostname and versions the managed image layer
• explains clearly which files survive VM replacement in the UI and agent instructions

Why

The Local VM previously stored every file and browser profile only in the container's writable layer. Recreating the container for an image or driver update therefore removed downloads, repositories, installed work, and authenticated browser sessions.

The VM is now disposable while one narrow workspace remains durable. Unexpected additional mounts are rejected instead of being exposed to a bot.

User impact

Users can recreate an outdated or unhealthy Local VM without losing files or browser sign-ins saved in the durable workspace. Existing VMs are intentionally marked for recreation once so they adopt the new storage boundary.

Validation

• pnpm test — 440 passed, 8 skipped
• pnpm build
• focused post-rebase tests — 57 passed
• live Docker Desktop image build and boot
• verified the unprivileged cua user can write the workspace
• verified files survive container removal and recreation
• verified Chrome/Chromium profile links and stale-lock cleanup after recreation

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d6cd5085-e1c9-475e-91ef-6dba52d3a9e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}