feat(name): embed agent CLI version in container names

deva--claude-v2.1.204--auth-file-max--proj..hash

Persistent containers pin the image they were created from. When the
image's CLI version moves, the old name matched and deva silently
attached a stale CLI to the same mounted config home — state schema
drift between CLI versions corrupts shared state. A version bump now
produces a distinct name, so a fresh container is created and the stale
one stays visible in deva ps.

- version read from org.opencontainers.image.<agent>_version image
  label, cached per run; check_image guarantees the image exists
  locally before any name is built
- label-less images keep the bare agent name (backward compatible)
- ps parsing unaffected: the version lives inside the agent segment,
  segments still split on double dash

Closes #420

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

CHANGELOG.md

@@ -20,6 +20,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `DEVA_TRACE=1` and removes it on the next non-traced start. Covers
   subprocesses and tools that ignore the CA env vars; never touches the
   host trust store
+- Container names embed the agent CLI version from the image label:
+  `deva--claude-v2.1.204--auth-file-max--proj..hash`. Persistent
+  containers pin old images; a CLI bump now creates a distinct container
+  instead of silently attaching a stale CLI to the same config home.
+  Label-less images keep the bare agent name (#420)
 
 ### Changed
 - cctrace pin bumped 0.4.0 -> 0.11.0 (client profiles, shape-first

deva.sh

@@ -929,6 +929,41 @@ compute_shape_hash() {
     short_hash "$combined" 8
 }
 
+# Agent CLI version from the image label. Persistent containers pin the
+# image they were created from; embedding the CLI version in the name keeps
+# version drift visible and stops silent attach to a stale-version container
+# sharing the same config home (#420). check_image runs before any name is
+# built, so the inspect is reliable; label-less images fall back to the
+# bare agent name.
+AGENT_VERSION_TAG_CACHE="__unset__"
+agent_version_tag() {
+    local agent="$1"
+
+    if [ "$AGENT_VERSION_TAG_CACHE" != "__unset__" ]; then
+        printf '%s' "$AGENT_VERSION_TAG_CACHE"
+        return
+    fi
+
+    local label=""
+    case "$agent" in
+        claude) label="org.opencontainers.image.claude_code_version" ;;
+        codex) label="org.opencontainers.image.codex_version" ;;
+        gemini) label="org.opencontainers.image.gemini_cli_version" ;;
+        grok) label="org.opencontainers.image.grok_cli_version" ;;
+    esac
+
+    local ver=""
+    if [ -n "$label" ]; then
+        ver=$(docker image inspect --format "{{ index .Config.Labels \"$label\" }}" "$(docker_image_ref)" 2>/dev/null | head -1)
+        [ "$ver" = "<no value>" ] && ver=""
+        # Container names allow [a-zA-Z0-9_.-]; drop anything else (keep dots)
+        ver=$(printf '%s' "$ver" | tr -cd 'a-zA-Z0-9._-')
+    fi
+
+    AGENT_VERSION_TAG_CACHE="$ver"
+    printf '%s' "$ver"
+}
+
 build_container_name() {
     local prefix="$1"
     local agent="$2"
@@ -938,7 +973,12 @@ build_container_name() {
     local ephemeral="${6:-false}"
     local pid="${7:-}"
 
-    local name="${prefix}--${agent}--${auth_tag}--${slug}..${shape_hash}"
+    local agent_seg="$agent"
+    local agent_ver
+    agent_ver="$(agent_version_tag "$agent")"
+    [ -n "$agent_ver" ] && agent_seg="${agent}-v${agent_ver}"
+
+    local name="${prefix}--${agent_seg}--${auth_tag}--${slug}..${shape_hash}"
     if [ "$ephemeral" = true ] && [ -n "$pid" ]; then
         name="${name}--${pid}"
     fi