Scrub the writable layer on the migration path too, and de-duplicate CLAUDE_JSON

Two integration fixes after merging the three feature branches.

`scrub_writable_layer` is a `docker exec`, so it only works while the
container runs. `migrate_project_to_base` stops its container one line
before the pre-swap commit, which meant the single largest snapshot
Triple-C ever takes was the one path that committed unscrubbed. Call the
scrub explicitly before the stop instead of relying on the call inside
`commit_container_snapshot`.

Also drop a duplicate `CLAUDE_JSON=` assignment in entrypoint.sh. The
Shift+Enter block re-declared it defensively to avoid a merge conflict
with the awsAuthRefresh block; the conflict did not materialise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

app/src-tauri/src/commands/migration_commands.rs

@@ -460,6 +460,13 @@ async fn fresh_migration(
         }
     }
 
+    // Scrub *before* the stop, not inside the commit below. `scrub_writable_layer`
+    // is a `docker exec`, which only works on a running container — and the
+    // pre-swap commit is the single largest snapshot Triple-C ever takes, so
+    // letting this one path commit unscrubbed is what the scrub exists to
+    // prevent. Failure is swallowed inside; it must never block a migration.
+    docker::scrub_writable_layer(&container_id).await;
+
     emit_progress(&app_handle, &project_id, "Stopping the container...");
     let _ = state
         .projects_store