feat: container-reachable MCP host for Docker harnesses

[jkbennitt]

Separate MCP bind host, advertised host, and port so a Linux Docker container (stock grok-build on Docker Desktop talking to host RimWorld) can reach the in-process MCP HTTP server.

Problem

McpHost bound 127.0.0.1 and picked an ephemeral port, advertising http://127.0.0.1:<port>/mcp. A container cannot reach that. Host RimWorld/RIMAPI stays on Windows :8765; the agent needs an MCP URL via host.docker.internal.

Behavior

Mode	Bind	Port	Advertised URL
Default (unchanged)	127.0.0.1	ephemeral (0)	http://127.0.0.1:<port>/mcp
Container-reachable	0.0.0.0	8766	http://host.docker.internal:8766/mcp

--docker (headless RimWorld in a container, RIMAPI on 8765) is unchanged. No Grok Dockerfiles in this repo (ADR-004).

How to enable

# .env / process env
MCP_CONTAINER_REACHABLE=true

# or harness-opt
python scripts/run_scenario.py crashlanded --harness grok-build \
  --harness-opt mcp_container_reachable=true

Overrides: MCP_BIND_HOST, MCP_ADVERTISE_HOST, MCP_PORT (same keys as --harness-opt). Harness options win over RLEConfig.

HeadlessCliHarness.setup() listens on the bind address and passes the advertised URL to start_agent.

Windows Docker Desktop / the OS firewall may prompt to allow Python on 8766. RimAPI remains localhost:8765.

Tests

URL construction and bind-vs-advertise (including an HTTP host that advertises host.docker.internal while still serving on loopback). No live Docker in CI.