ci: use packaged tarball for docker e2e

scripts/e2e/mcp-channels-docker.sh

@@ -1,4 +1,6 @@
 #!/usr/bin/env bash
+# Runs a Docker Gateway plus MCP stdio bridge smoke with seeded conversations and
+# raw Claude notification-frame assertions.
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -18,6 +20,7 @@ trap cleanup EXIT
 docker_e2e_build_or_reuse "$IMAGE_NAME" mcp-channels
 
 echo "Running in-container gateway + MCP smoke..."
+# Harness files are mounted read-only; the app under test comes from /app/dist.
 set +e
 docker run --rm \
   --name "$CONTAINER_NAME" \
@@ -33,6 +36,7 @@ docker run --rm \
   -e "GW_URL=ws://127.0.0.1:$PORT" \
   -e "GW_TOKEN=$TOKEN" \
   -e "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1" \
+  -v "$ROOT_DIR/scripts/e2e:/app/scripts/e2e:ro" \
   "$IMAGE_NAME" \
   bash -lc "set -euo pipefail
     entry=dist/index.mjs