fa9fed4194
merge_bottles_runtime sees resolved bottles, where a bottle that never mentioned the key is indistinguishable from one that set it false. With "later replaces" semantics, `--bottle with-containers --bottle claude-dev` silently dropped the capability — the second bottle's default clobbered it. OR instead: composing bottles adds capabilities, it does not remove them. The file-based extends path still sees raw keys, so an explicit `nested_containers: false` in a child continues to turn it back off. Also surface the flag in the launch summary, where its absence was the only reason the clobber went unnoticed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>