docs(docker): link the container setup from the README, bot and MCP docs

docs/mcp.md

@@ -85,7 +85,7 @@ Configured values win over the variables; an empty variable counts as unset. The
 The server needs Node and the Chromium build that the pinned `@playwright/mcp` expects:
 `npx playwright install --with-deps chromium`, run from that package so the versions match
 (`PLAYWRIGHT_BROWSERS_PATH` is honoured). The first `npx` run downloads the package, which is why the preset allows
-120 s to start. The Docker image (`docker.md`, when the docker-deployment spec lands) preinstalls both and sets
+120 s to start. The Docker image ([docker.md](docker.md), built with `INSTALL_PLAYWRIGHT=true`) preinstalls both and sets
 `PLAYWRIGHT_COMMAND=playwright-mcp` and `PLAYWRIGHT_EXTRA_ARGS=--no-sandbox`. Chromium's sandbox needs user namespaces,
 which Docker's default profile blocks, so there the container is the isolation boundary. A missing browser shows up as
 an error from the first `browser_*` call.

docs/superpowers/specs/2026-09-25-telegram-host-design.md

@@ -20,7 +20,7 @@ Chat with the agent through a Telegram bot. A new host project in this repo, run
 | Access | Mandatory user-id allow-list; empty list = refuse to start; other users are ignored silently |
 | Chats | Private chats only |
 
-Out of scope: webhooks, Docker/Coolify, voice and documents, group chats, several bot tokens, a custom polling loop.
+Out of scope: webhooks, Docker/Coolify (see `2026-09-26-docker-deployment-design.md`), voice and documents, group chats, several bot tokens, a custom polling loop.
 
 ## Configuration
 

docs/superpowers/specs/2026-09-26-mcp-client-playwright-design.md

@@ -1,7 +1,7 @@
 # MCP client extension and Playwright browser tools — design
 
 Date: 2026-09-26
-Status: implemented (the Dockerfile version test arrives with 2026-09-26-docker-deployment-design.md)
+Status: implemented (the Dockerfile version test, PlaywrightPresetTests.Dockerfile_version_matches_DefaultPackage, landed with 2026-09-26-docker-deployment-design.md)
 Depends on: `2026-09-26-telegram-attachments-design.md` (the `send` tool that delivers browser output);
 `2026-09-26-process-environment-hook-design.md` (the environment every server process gets, and the redaction of
 known secrets in tool output).
@@ -393,8 +393,8 @@ No test touches the network, npm or a real browser.
     `settings.json` merge and precedence;
   - Playwright preset: argv for headless/browser/extra args, output dir and profile under the workspace, a pinned
     package; with `PLAYWRIGHT_COMMAND` the binary is used and `-y <package>` is dropped; the Dockerfile's
-    `PLAYWRIGHT_MCP_VERSION` default equals `DefaultPackage`'s version (deferred: the Dockerfile and that test come with the
-    docker-deployment spec); the prompt section appears only with `browser_*` tools active and mentions `send` only when it exists;
+    `PLAYWRIGHT_MCP_VERSION` default equals `DefaultPackage`'s version (`Dockerfile_version_matches_DefaultPackage`, added
+    with the docker-deployment spec); the prompt section appears only with `browser_*` tools active and mentions `send` only when it exists;
   - end to end through the core with `FauxProvider`: the scripted model calls the fake `image` tool, and the tool
     result message holds the image.
 - **Claude Code**: a `ToolCatalog` test that `browser_navigate`-style names alias to themselves (no digest).

docs/telegram-bot.md

@@ -193,8 +193,9 @@ storage and time zones are in [google-calendar.md](google-calendar.md).
 ## Security
 
 The agent has the built-in tools, including `bash`, and runs them as the bot's OS user. Only allow-listed user ids
-are served (everyone else is ignored and logged), and only in private chats. Run the bot as a dedicated user or in a
-container, and treat the workspace root as writable by anyone on the allow-list.
+are served (everyone else is ignored and logged), and only in private chats. Run it in the container image
+([docker.md](docker.md)), which is the recommended setup, or at least as a dedicated user, and treat the workspace root
+as writable by anyone on the allow-list.
 
 Scheduled watcher scripts run unattended as the bot's OS user, with the same trust as the `bash` tool that every
 allow-listed user already has, and the same filtered environment.
@@ -211,8 +212,8 @@ agent can use `gh`. At startup the bot logs which rules apply, names only:
 
 On Linux the bot's own environment can't be read through `/proc/<pid>/environ` or ptrace: at startup the process
 makes itself non-dumpable (`prctl(PR_SET_DUMPABLE, 0)`). Set `DOTNET_EnableDiagnostics=0` in the bot's environment
-too (a container image should set it): otherwise the .NET diagnostic socket still hands the environment to any process
-of the same user, and the bot logs a warning saying so.
+too (the Docker image, [docker.md](docker.md), sets it): otherwise the .NET diagnostic socket still hands the
+environment to any process of the same user, and the bot logs a warning saying so.
 
 The bot token and the other configured secrets are replaced by `[REDACTED]` in tool output, so the model never sees
 them in a tool result, whichever file or process they were read from. Encoded forms (base64, URL-encoded, split