1. Blueprint updates - Added NO_GROUPS escalation docs to all 12 agent blueprints

2. Multi-image Docker architecture - Created role-specific Dockerfiles:
  - agent-base.Dockerfile (shared foundation)
  - agent-pm.Dockerfile, agent-dev-be.Dockerfile, agent-dev-fe.Dockerfile
  - agent-qa-be.Dockerfile, agent-qa-fe.Dockerfile, agent-doc.Dockerfile, agent-ux.Dockerfile
3. Orchestrator updates - roboco/runtime/orchestrator.py:
  - Added AGENT_IMAGES mapping and get_agent_image() function
  - Updated _ensure_agent_image() to build base + specialized images
  - Updated _spawn_container() to use role-specific image
  - Made _generate_mcp_config() role-aware (though kept notify for all since they need to receive)

docker/agent-base.Dockerfile

@@ -0,0 +1,47 @@
+FROM debian:bookworm-slim
+
+# Install dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    ca-certificates \
+    git \
+    python3 \
+    python3-pip \
+    python3-venv \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js 22
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Claude Code CLI
+RUN npm install -g @anthropic-ai/claude-code
+
+# Install uv for Python package management
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+
+# Create agent user BEFORE copying files
+RUN useradd -m -s /bin/bash agent
+
+# Create app directory and set ownership
+WORKDIR /app
+RUN chown agent:agent /app
+
+# Copy MCP server code (needed for agent tools) AS agent
+COPY --chown=agent:agent roboco /app/roboco
+COPY --chown=agent:agent pyproject.toml uv.lock README.md /app/
+
+# Switch to agent user for installing dependencies
+USER agent
+
+# Install Python dependencies for MCP servers (as agent)
+ENV UV_HTTP_TIMEOUT=300
+ENV UV_CONCURRENT_DOWNLOADS=4
+RUN uv python install 3.13 && uv sync --frozen --python 3.13
+
+# Claude Code will use mounted ~/.claude for auth
+# Blueprints mounted at /app/agents/blueprints
+# MCP config generated at runtime
+
+ENTRYPOINT ["claude"]