feat(state): preserve on crash + always snapshot transcript

Extends the preserve-on-capability-block design to also preserve
state on agent crash, and snapshots the transcript on every
teardown so any resume (crash or capability-block) gets a warm
claude session — not a cold start.

- capability_apply: rename _snapshot_transcript → snapshot_transcript
  (public; reused below). No behavior change in the capability path.
- cli/start.py: capture bottle.exec_claude's exit code; while the
  container is still alive (inside the launch context):
    * always snapshot_transcript(identity)
    * if exit_code != 0, mark_preserved(identity)
  Then the existing _settle_state runs after teardown.

Now the preservation matrix is:

  exit 0   (clean)          → snapshot + cleanup state
  exit ≠0  (crash, Ctrl-C)  → snapshot + preserve + show resume hint
  capability-block          → (already snapshotted/preserved by apply
                               before teardown; this path is a no-op
                               because the container is already gone
                               by the time exec_claude returns)

snapshot_transcript is best-effort — capability-block's earlier
snapshot is not clobbered when the container is already torn down,
and a missing /home/node/.claude is a warn + skip.

Tested behavior: clean exit doesn't preserve, non-zero exit
(including SIGINT/130 and SIGKILL/137) preserves; empty identity
no-ops both helpers.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/test_cli_start_settle.py

@@ -0,0 +1,93 @@
+"""Unit: cli/start.py session-end state capture (crash preservation).
+
+The launch-context machinery is covered by integration; this isolates
+the post-exec_claude decision: snapshot transcript + mark for
+preservation if non-zero exit, no-op for clean exit."""
+
+import tempfile
+import unittest
+from pathlib import Path
+
+from claude_bottle import supervise
+from claude_bottle.backend.docker import bottle_state
+from claude_bottle.cli import start as start_mod
+
+
+class _FakeHomeMixin:
+    def _setup_fake_home(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="cli-start-settle.")
+        self._original = supervise.claude_bottle_root
+
+        def fake_root() -> Path:
+            return Path(self._tmp.name) / ".claude-bottle"
+
+        supervise.claude_bottle_root = fake_root  # type: ignore[assignment]
+
+    def _teardown_fake_home(self):
+        supervise.claude_bottle_root = self._original  # type: ignore[assignment]
+        self._tmp.cleanup()
+
+
+class TestCaptureSessionState(_FakeHomeMixin, unittest.TestCase):
+    def setUp(self):
+        self._setup_fake_home()
+        # Stub the docker-dependent snapshot call so this stays a
+        # unit test. apply_capability_change's integration test
+        # covers the real docker cp path.
+        self._snap_calls: list[str] = []
+        self._orig_snap = start_mod.snapshot_transcript
+        start_mod.snapshot_transcript = lambda identity: (
+            self._snap_calls.append(identity)
+        )
+
+    def tearDown(self):
+        start_mod.snapshot_transcript = self._orig_snap
+        self._teardown_fake_home()
+
+    def test_clean_exit_snapshots_but_does_not_mark(self):
+        start_mod._capture_session_state("dev-abc", exit_code=0)
+        self.assertEqual(["dev-abc"], self._snap_calls)
+        self.assertFalse(bottle_state.is_preserved("dev-abc"))
+
+    def test_crash_snapshots_and_marks(self):
+        start_mod._capture_session_state("dev-abc", exit_code=137)
+        self.assertEqual(["dev-abc"], self._snap_calls)
+        self.assertTrue(bottle_state.is_preserved("dev-abc"))
+
+    def test_ctrl_c_treated_as_crash(self):
+        # SIGINT delivers exit 130; the operator may have Ctrl-C'd
+        # because something went wrong, so we preserve.
+        start_mod._capture_session_state("dev-abc", exit_code=130)
+        self.assertTrue(bottle_state.is_preserved("dev-abc"))
+
+    def test_empty_identity_is_noop(self):
+        # Backends without an identity field shouldn't crash this
+        # path (the _identity_from_plan helper falls back to "").
+        start_mod._capture_session_state("", exit_code=137)
+        self.assertEqual([], self._snap_calls)
+
+
+class TestSettleState(_FakeHomeMixin, unittest.TestCase):
+    def setUp(self):
+        self._setup_fake_home()
+
+    def tearDown(self):
+        self._teardown_fake_home()
+
+    def test_preserved_state_survives(self):
+        bottle_state.write_per_bottle_dockerfile("dev-abc", "FROM x\n")
+        bottle_state.mark_preserved("dev-abc")
+        start_mod._settle_state("dev-abc")
+        self.assertTrue(bottle_state.bottle_state_dir("dev-abc").is_dir())
+
+    def test_unpreserved_state_is_cleaned(self):
+        bottle_state.write_per_bottle_dockerfile("dev-abc", "FROM x\n")
+        start_mod._settle_state("dev-abc")
+        self.assertFalse(bottle_state.bottle_state_dir("dev-abc").exists())
+
+    def test_empty_identity_is_noop(self):
+        start_mod._settle_state("")  # should not raise
+
+
+if __name__ == "__main__":
+    unittest.main()