Add opt-in root access, persistent containers and per-project packages

Containerfile

@@ -4,14 +4,19 @@ FROM docker.io/library/debian:stable-slim
 
 # Base tools Claude Code relies on. Add project-wide tools here (python3, nodejs, ...).
 # The second line is for GUI=1 / AUDIO=1: OpenGL drivers, a font, PulseAudio client.
+# sudo is for ROOT=1: the "sudo" group gets passwordless root. claude is not a
+# member; claudio.sh adds the group at run time only when ROOT=1.
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       ca-certificates curl git ripgrep less procps openssh-client \
-      libgl1-mesa-dri fonts-dejavu-core libpulse0 libasound2-plugins \
+      libgl1-mesa-dri fonts-dejavu-core libpulse0 libasound2-plugins sudo \
  && rm -rf /var/lib/apt/lists/* \
  && useradd -m -u 1000 -s /bin/bash claude \
  && install -d -m 700 -o claude -g claude /run/user/1000 \
- && printf 'pcm.!default pulse\nctl.!default pulse\n' > /etc/asound.conf
+ && printf 'pcm.!default pulse\nctl.!default pulse\n' > /etc/asound.conf \
+ && echo '%sudo ALL=(ALL:ALL) NOPASSWD: ALL' > /etc/sudoers.d/claudio \
+ && chmod 440 /etc/sudoers.d/claudio \
+ && echo 'Set disable_coredump false' >> /etc/sudo.conf
 
 # Native Claude Code binary, installed system-wide (not in $HOME) so that image
 # rebuilds update it even though /home/claude is a persistent volume.