fix(proxy): daemon-style claude container — survives without TTY

ENTRYPOINT was claude, so the container's life was tied to a single
claude invocation. docker compose up (no attached TTY) → claude exits
immediately → container dies. Only docker compose run --rm with an
attached terminal kept it alive, which doesn't match how the sandbox
is meant to be used.

Now ENTRYPOINT is sleep infinity and compose pins the same. The
container stays up; users do `docker compose exec claude claude` for
interactive or one-shot sessions, or `docker compose run --rm
--entrypoint claude claude` for ephemeral runs.

proxy/Dockerfile

@@ -10,4 +10,7 @@ RUN apt-get update \
 
 RUN npm install -g @anthropic-ai/claude-code
 
-ENTRYPOINT ["claude"]
+# Daemon-style: container stays alive so users `docker compose exec` claude
+# inside it. For one-shot invocations: `docker compose run --rm
+# --entrypoint claude claude [-p 'prompt']`.
+ENTRYPOINT ["sleep", "infinity"]

proxy/compose.yml

@@ -17,10 +17,13 @@
 #             match without poisoning cf-proxy's own DNS view.
 #
 # Usage:
-#   cp .env.example .env && $EDITOR .env       # set PROXY_PASSWORD and
+#   cp .env.example .env && $EDITOR .env       # PROXY_PASSWORD and
 #                                                CF_ACCESS_CLIENT_ID/SECRET
-#   docker compose run --rm claude             # interactive session
+#   docker compose up -d claude                # bring up the sandbox
-#   docker compose run --rm claude -p 'ping'   # one-shot
+#   docker compose exec claude claude          # interactive session
+#   docker compose exec claude claude -p 'ping'  # one-shot inside the sandbox
+#   docker compose run --rm --entrypoint claude claude [-p 'ping']
+#                                              # ephemeral one-shot
 #
 # Notes:
 # - claude-home is a named volume so login state persists across runs.
@@ -47,6 +50,10 @@ services:
     container_name: cc-claude
     depends_on:
       - cf-proxy
+    # Long-running so users docker exec into it. claude itself is launched
+    # per-session via `docker compose exec claude claude`.
+    entrypoint: ["sleep", "infinity"]
+    restart: unless-stopped
     networks:
       - proxy_net
     extra_hosts:
@@ -61,8 +68,6 @@ services:
       - /home/care/acoharmony:/home/care/acoharmony
       - /opt/s3/data/workspace:/opt/s3/data/workspace
       - /opt/s3/data/notebooks:/opt/s3/data/notebooks
-    stdin_open: true
-    tty: true
 
 networks:
   proxy_net: