This completes Step 12 of the AI harness plugin-instance plan by replacing the tool auth container session contract's persona field with explicit plugin instance identity. Controller request and response schemas, auth image refs, build payloads, dev-shell websocket forwarding, Docker labels, container env, and shared probe metadata now carry plugin_id, instance_id, and driver_id.

The controller now rejects mismatched plugin or driver identity, uses PLUGIN_INSTANCE_ID instead of TOOL_PERSONA_ID in auth containers, and labels containers/images with current plugin and driver keys. The app-side auth container client and session helpers send the new payload shape without accepting the old persona_id request field.

Validated with: pytest for the container image controller client, AI tool auth containers, and container image controller integration files; compileall for touched controller/app/contract/test modules; git diff --check; targeted cleanup search for removed tool-auth persona fields, env vars, labels, and probe keys in the edited boundary.

@@ -949,3 +975,3 @@
         f"TOOL_AUTH_STORAGE_KEY={session.auth_storage_key}",
         f"TOOL_AUTH_HOST_PATH={host_dir}",
-        f"TOOL_AUTH_PROFILE_JSON={json.dumps(profile.probe_config(), sort_keys=True, separators=(',', ':'))}",
+        f"TOOL_AUTH_PROFILE_JSON={json.dumps(profile.controller_payload(), sort_keys=True, separators=(',', ':'))}",

@@ -316,3 +318,3 @@
 async def dev_shell_websocket(websocket: WebSocket) -> None:
     command_id = websocket.query_params.get("command", "bash")
-    persona_id = websocket.query_params.get("persona_id")
+    instance_id = websocket.query_params.get("instance_id")