On macOS, Docker Desktop manages file-sharing permissions via its
gRPC/SSH layer. Passing -u <host-uid>:<host-gid> to one-shot wrapper
containers causes a UID mismatch: the data volume is owned by the
container's internal uid 1000 (the ai-memory user), but the host
UID on macOS is typically 501/502.
This causes one-shot commands (status, install-mcp, install-hooks,
etc.) to crash with:
thread 'main' panicked at .../rolling.rs:156:14:
initializing rolling file appender failed: InitError {
context: "failed to create log file",
source: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }
}
Fix: only pass -u on non-macOS platforms. On macOS, omitting -u lets
the container run as its default uid 1000 which matches the volume
owner. Docker Desktop's file sharing handles the rest.
Also fixes unbound variable errors (set -u) for TTY_ARGS, NETWORK_ARGS,
and ENV_ARGS arrays that may be empty.
