feat: sync portal runtime fixes for release

user-auth.mjs

@@ -1662,6 +1662,11 @@ export function createUserAuth(pool, options = {}) {
       try {
         const layout = await publishLayoutFor(user, { migrateLegacy: false });
         sandboxMcp = {
+          // When goosed runs in a container its filesystem is split from the portal's,
+          // so the host paths the portal would otherwise send (node binary, MCP script)
+          // are not resolvable. These env overrides let the portal send container-canonical
+          // paths instead. Unset (e.g. local dev, co-located native goosed) => fall back to
+          // the portal's own paths, so behavior is unchanged.
           serverPath: resolveSandboxMcpServerPath(process.env.GOOSED_MCP_SERVER_PATH),
           sandboxRoot: layout.publishDir,
           userId: user.id,
@@ -2709,7 +2714,6 @@ export function createUserAuth(pool, options = {}) {
     policyCatalog: POLICY_CATALOG,
     skillCatalog,
     publicUser,
-    getUserById,
   };
 }