fix(dev): use mounted AWS login cache in containers

[proton0210]

Description

Container agents using aws login can fail with LoginTokenLoadError because botocore looks for its login cache under the container user's home even though the host AWS directory is mounted at /aws-config.

In ContainerDevRunner.run(), default AWS_LOGIN_CACHE_DIRECTORY to /aws-config/login/cache whenever that AWS directory is mounted. A caller-supplied container cache path takes precedence. The value is written to the existing protected environment file, and the credential directory stays mounted read-only.

This change targets refactor, based on c480abb (1.0.0-rc.6), as requested in #2606. The fix and regression tests use that branch's src/core/dev implementation and Bun test harness.

Related Issue

Closes #2606.

Supersedes #2613 on the requested release branch.

Documentation PR

Not applicable: restores an existing credential source without adding a CLI option.

Type of Change

• Bug fix

Testing

• Regression first: the shared-config assertion and all three Docker/Podman/Finch login-cache tests failed before the production change. All 34 container-runner tests pass with the fix, including explicit container cache overrides, environment-file cleanup, and existing explicit-credential behavior.

• Full bun test: 4,578 tests passed across 307 files, 6 snapshots, zero failures.

• bun run typecheck, bun run lint:check, bun run format:check, bun run build, and bun run secrets:check pass. git diff --check passes.

• bun run audit: no vulnerabilities found across 797 packages, using the branch's existing single-advisory exclusion.

• Built Node bundle smoke checks: --version reports 1.0.0-rc.6; --help succeeds.

• Tested with Bun 1.4.0 and Node 24.19.0, using bun install --frozen-lockfile; no dependency or lockfile changes.

• Relevant live AWS/container E2E tests were not run. The change is local credential-cache path configuration, covered through injected container-process boundaries with synthetic AWS config and temporary environment files. No real login tokens were read, refreshed, or modified.

• I ran bun test

• I ran the relevant end-to-end tests with bun run test:e2e, or explained why they are not applicable

• I ran bun run typecheck

• I ran bun run lint:check

• I ran bun run format:check

• I ran bun run build

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.