fix(security): mount host Docker socket only in aio (DooD) sandbox mode (#3517)

* fix(security): mount host Docker socket only in aio (DooD) sandbox mode

The default Compose stack mounted /var/run/docker.sock read-write into the
root gateway container in every sandbox mode, including the default `local`
mode that never uses it -- an unnecessary host-escape surface (DooD =
root-equivalent host control). deploy.sh already gated the socket *check* on
sandbox_mode != local, but the Compose files mounted it unconditionally.

Move the socket mount to an opt-in docker/docker-compose.dood.yaml overlay
that deploy.sh / docker.sh append only when detect_sandbox_mode() returns
`aio`. Default (local) and provisioner/Kubernetes modes no longer expose the
host daemon. Tighten the socket existence check from != local to == aio.
Document the DooD threat model in SECURITY.md.

Reported by @greatmengqi.

* refactor(docker): address review on socket-hardening PR

- docker.sh: use absolute path for the dood overlay (match deploy.sh, drop cwd dependency)
- deploy.sh: drop now-dead DEER_FLOW_DOCKER_SOCKET exports in down/build paths
- docker-compose.yaml: fix stale header comment to point at the overlay

Addresses codex + reviewer feedback on #3517.

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

docker/docker-compose.dood.yaml

@@ -0,0 +1,25 @@
+# DeerFlow — Docker-out-of-Docker (DooD) overlay (OPT-IN, NOT loaded by default)
+#
+# Mounts the host Docker socket into the gateway container so that
+# AioSandboxProvider running in pure-Docker mode — config.yaml:
+#   sandbox.use: deerflow.community.aio_sandbox:AioSandboxProvider
+# with NO provisioner_url — can start per-thread sandbox containers via the
+# host Docker daemon.
+#
+# SECURITY: the host Docker socket grants the gateway container
+# root-equivalent control of the host. Only load this overlay when you have
+# explicitly chosen aio (DooD) sandbox mode and accept that trade-off. The
+# default LocalSandboxProvider and the provisioner/Kubernetes mode do NOT need
+# it and never load this file. See SECURITY.md for the full threat model.
+#
+# scripts/deploy.sh and scripts/docker.sh append this overlay automatically
+# only when detect_sandbox_mode() returns "aio". Manual use:
+#   docker compose -f docker-compose.yaml -f docker-compose.dood.yaml up -d
+#
+# Compatible with both docker-compose.yaml (prod) and docker-compose-dev.yaml
+# (dev): both define a `gateway` service, and Compose merges this volume entry
+# onto it. DEER_FLOW_DOCKER_SOCKET defaults to /var/run/docker.sock.
+services:
+  gateway:
+    volumes:
+      - ${DEER_FLOW_DOCKER_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock