fix: restrict docker commands for ai-worker user

Remove ai-worker from docker group and enforce sudo whitelist.

SECURITY: Being in the docker group gives unrestricted access to the
Docker daemon socket (/var/run/docker.sock), allowing any docker command:
docker exec, docker cp, docker run -v /:/host, docker commit, etc.

Changes:
- Remove extraGroups = ["docker"] from ai-worker user definition
- Add comprehensive sudo NOPASSWD whitelist for safe docker subcommands
  ALLOWED: ps, inspect, logs, images, info, version, stats, start, stop,
  restart, rm, rmi, wait, pull, build, run, compose, system,
  network ls, volume ls
  BLOCKED (implicitly): exec, cp, commit, diff, export, import, load,
  save, attach, push, tag, create, plugin, network create, volume create
- Update ai-worker-restricted.nix module to reflect new approach
- Update README-ai-worker.md with new security model and examples

All docker commands must now be prefixed with sudo.
The Hermes agent's host_run tool needs to be updated to prepend sudo.

modules/nixos/security/ai-worker-restricted.nix

@@ -6,12 +6,19 @@ with lib;
   options.services.aiWorkerAccess = mkOption {
     type = types.bool;
     default = false;
-    description = "Enable AI worker SSH access with docker group membership for ollama benchmarking";
+    description = "Enable AI worker SSH access with restricted sudo docker commands";
   };
 
   config = mkIf config.services.aiWorkerAccess {
-    # ai-worker is member of docker group - can run docker commands via SSH
-    # No bind mounts, no sudo access - docker-only for ollama benchmarking
-    users.groups.docker.members = [ "ai-worker" ];
+    # SECURITY: ai-worker is NOT added to docker group.
+    # Docker access is granted via sudo whitelist in users/ai-worker.nix.
+    # This prevents unrestricted docker daemon access (docker exec, cp, commit, etc.)
+    # Only specific docker subcommands are allowed via sudo NOPASSWD rules.
+    
+    # The old approach (docker group membership) has been removed because:
+    # - Docker group gives UNRESTRICTED access to the docker daemon socket
+    # - No way to limit which docker subcommands a docker group member can run
+    # - Allowed: docker exec, docker cp, docker run -v /:/host, etc.
+    # users.groups.docker.members = [ "ai-worker" ];  // REMOVED
   };
 }