ci: use packaged tarball for docker e2e

scripts/e2e/crestodian-first-run-docker.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# Runs the Crestodian first-run Docker smoke against the package-installed
+# functional E2E image, with only the test harness mounted from the checkout.
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -16,11 +18,13 @@ trap cleanup EXIT
 docker_e2e_build_or_reuse "$IMAGE_NAME" crestodian-first-run
 
 echo "Running in-container Crestodian first-run smoke..."
+# Harness files are mounted read-only; the app under test comes from /app/dist.
 set +e
 docker run --rm \
   --name "$CONTAINER_NAME" \
   -e "OPENCLAW_STATE_DIR=/tmp/openclaw-state" \
   -e "OPENCLAW_CONFIG_PATH=/tmp/openclaw-state/openclaw.json" \
+  -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \
   "$IMAGE_NAME" \
   bash -lc "set -euo pipefail
     node --import tsx scripts/e2e/crestodian-first-run-docker-client.ts