Scrub the writable layer on the migration path too, and de-duplicate CLAUDE_JSON

Two integration fixes after merging the three feature branches.

`scrub_writable_layer` is a `docker exec`, so it only works while the
container runs. `migrate_project_to_base` stops its container one line
before the pre-swap commit, which meant the single largest snapshot
Triple-C ever takes was the one path that committed unscrubbed. Call the
scrub explicitly before the stop instead of relying on the call inside
`commit_container_snapshot`.

Also drop a duplicate `CLAUDE_JSON=` assignment in entrypoint.sh. The
Shift+Enter block re-declared it defensively to avoid a merge conflict
with the awsAuthRefresh block; the conflict did not materialise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc

container/entrypoint.sh

@@ -480,7 +480,8 @@ fi
 # already in place, so it keeps printing its "run /terminal-setup" tip. This
 # flag is what that tip is gated on: purely cosmetic, and it changes nothing
 # about how the sequence is decoded.
-CLAUDE_JSON="/home/claude/.claude.json"
+#
+# $CLAUDE_JSON is already set by the awsAuthRefresh block above.
 if [ -f "$CLAUDE_JSON" ]; then
     # Only rewrite when the value isn't already true, to avoid a needless jq
     # reformat of ~/.claude.json on every single start.