feat: add skip-cleanup flag and fix api-proxy shutdown

Add --skip-cleanup CLI flag to skip cleanup operations in CI environments
where the runner terminates anyway, saving ~10 seconds per workflow run.

Changes:
- Add skipCleanup option to WrapperConfig interface
- Add --skip-cleanup CLI flag with documentation
- Skip container stop, iptables cleanup, and workdir removal when enabled
- Fix api-proxy Dockerfile to use exec form CMD for instant SIGTERM response

The api-proxy container previously used shell form CMD with tee pipeline,
causing 10s timeout on shutdown. Now uses exec form so Node.js becomes
PID 1 and handles SIGTERM gracefully.

Author: dsyme

containers/api-proxy/Dockerfile

@@ -30,6 +30,6 @@ USER apiproxy
 # 10004 - OpenCode API proxy (routes to Anthropic)
 EXPOSE 10000 10001 10002 10004
 
-# Redirect stdout/stderr to log file for persistence
-# Use shell form to enable redirection and tee for both file and console
-CMD node server.js 2>&1 | tee -a /var/log/api-proxy/api-proxy.log
+# Use exec form so Node.js is PID 1 and receives SIGTERM directly
+# Docker captures stdout/stderr automatically, no need for manual log redirection
+CMD ["node", "server.js"]

src/cli.ts

@@ -696,6 +696,11 @@ program
     'Keep containers running after command exits',
     false
   )
+  .option(
+    '--skip-cleanup',
+    'Skip all cleanup (containers, iptables, work dir) - useful in CI where runner terminates anyway',
+    false
+  )
   .option(
     '--tty',
     'Allocate a pseudo-TTY for the container (required for interactive tools like Claude Code)',
@@ -1062,6 +1067,7 @@ program
       agentCommand,
       logLevel,
       keepContainers: options.keepContainers,
+      skipCleanup: options.skipCleanup,
       tty: options.tty || false,
       workDir: options.workDir,
       buildLocal: options.buildLocal,
@@ -1180,6 +1186,12 @@ program
         logger.info(`Received ${signal}, cleaning up...`);
       }
 
+      // Skip all cleanup if requested (useful in CI where runner terminates anyway)
+      if (config.skipCleanup) {
+        logger.info('Skipping cleanup (--skip-cleanup enabled)');
+        return;
+      }
+
       if (containersStarted) {
         await stopContainers(config.workDir, config.keepContainers);
       }

src/types.ts

@@ -131,6 +131,23 @@ export interface WrapperConfig {
    */
   keepContainers: boolean;
 
+  /**
+   * Whether to skip cleanup when the process exits
+   *
+   * When true:
+   * - Containers are not stopped (left running or stopped by Docker daemon)
+   * - Host iptables rules are not cleaned up
+   * - Work directory is not deleted
+   * - Useful in CI environments where the runner will terminate anyway,
+   *   saving ~10 seconds of shutdown time
+   *
+   * This is a stronger version of keepContainers that also skips all cleanup
+   * operations, not just container removal.
+   *
+   * @default false
+   */
+  skipCleanup?: boolean;
+
   /**
    * Whether to allocate a pseudo-TTY for the agent execution container
    *