agent v0.36.6: shared parent make-private before make-shared (ROOT CAUSE of double-bind)

The self-bind inherited /'s shared peer group, so binds under /mnt/felhom-drives
propagated back and doubled. make-private (own group) before make-shared fixes it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/localapi/intermediary.go

@@ -33,6 +33,10 @@ const sharedParentScript = `#!/bin/sh
 set -e
 mkdir -p ` + StableParentDir + `
 mountpoint -q ` + StableParentDir + ` || mount --bind ` + StableParentDir + ` ` + StableParentDir + `
+# make-PRIVATE first: the self-bind inherits the root mount's shared peer group, so without detaching it
+# every drive bind under the parent would propagate back (and DOUBLE). Then make-shared = its OWN group,
+# whose only slave is the guest's parent bind → binds propagate to the guest exactly once.
+mount --make-private ` + StableParentDir + `
 mount --make-shared ` + StableParentDir + `
 `
 
@@ -95,6 +99,12 @@ func (b *GuestBinder) EnsureSharedParent(ctx context.Context) error {
 			return fmt.Errorf("shared-parent: self-bind: %w", err)
 		}
 	}
+	// make-PRIVATE first to detach from the root mount's shared peer group (the self-bind inherits it),
+	// THEN make-shared so the parent owns its OWN group — otherwise binds under it propagate back via the
+	// root peer and DOUBLE (observed live as 2 stacked binds per drive).
+	if err := b.run(ctx, "mount", "--make-private", StableParentDir); err != nil {
+		return fmt.Errorf("shared-parent: make-private: %w", err)
+	}
 	if err := b.run(ctx, "mount", "--make-shared", StableParentDir); err != nil {
 		return fmt.Errorf("shared-parent: make-shared: %w", err)
 	}