contrib: devbox-aware scheduler templates (host-side, docker exec)

On hosts running a long-lived opencode-devbox (or equivalent)
container, mempalace-session lives INSIDE the container, not on
the host. The existing contrib/* templates install a scheduler on
the machine that runs the tool; for the devbox case the scheduler
has to live on the host and reach into the container via
'docker exec'. This was noted in passing in contrib/README.md but
no templates were actually shipped for it.

Adds parallel *-devbox templates for systemd and cron:

contrib/systemd/mempalace-session-devbox.service
  - Type=oneshot, same 2h TimeoutStartSec + low Nice as the direct
    variant.
  - Two Environment knobs (CONTAINER, CONTAINER_USER) default to
    opencode-devbox/developer, overrideable via
    'systemctl --user edit'.
  - ExecCondition checks 'docker ps --filter name= --filter
    status=running' so the unit no-ops cleanly when the container
    is currently down. systemd reports this as a successful
    'condition failed' state — no alert noise across dev cycles
    of teardown/rebuild.
  - ExecStart is plain /usr/bin/docker exec with no shell; systemd
    does the env-var expansion.
  - Stdout/stderr go to journalctl --user -u <unit> (nothing to
    redirect, since docker exec surfaces container output to the
    calling process).

contrib/systemd/mempalace-session-devbox.timer
  - Mon 03:00 Persistent=true RandomizedDelaySec=30m, mirrors the
    direct timer.

contrib/cron/mempalace-session-devbox.cron
  - Equivalent shell-wrapped form for hosts using cron instead of
    systemd. 'docker ps | grep -q .' short-circuits if the container
    isn't running. Log goes to $HOME/.cache/mempalace-session/
    cron-devbox.log on the HOST (outside the container) so it's
    inspectable without dropping into the devbox.

contrib/README.md:
  - Replaces the two-paragraph 'Running inside a container' note
    with a proper section: preconditions, install recipes for both
    the systemd and cron devbox variants, verify/uninstall commands,
    customization via 'systemctl --user edit', behaviour when the
    container is down.
  - Chooser table gains a dedicated row pointing devbox users at
    the *-devbox templates, and mentions the systemd vs cron pick
    for that case.
  - New 'When to pick devbox variants vs direct ones' table covers
    the rare both-installed case (host mempalace AND in-container
    mempalace see separate palaces — they don't cross-pollinate).

Top-level README.md 'Keeping it fresh' subsection gains a quick-start
block for the devbox variant alongside the existing Linux/macOS
quick-starts.

Tested: all four systemd units parse cleanly as INI via
configparser (sections + key=value pairs); validated file sizes
and locations match the layout described in docs. Runtime
validation (systemctl --user enable; actual docker exec) requires
a host with docker + an opencode-devbox container up — deferred
to the user's Mac/Linux boxes.

contrib/systemd/mempalace-session-devbox.service

@@ -0,0 +1,34 @@
+[Unit]
+Description=Mine opencode session history into MemPalace (inside opencode-devbox container)
+Documentation=https://gitea.jordbo.se/joakimp/mempalace-toolkit
+# Only run if docker is reachable AND the container is currently up.
+# The ExecCondition below gives us the "container running" check at fire
+# time; these unit-level conditions just skip pointless scheduling churn
+# on boxes where docker isn't even installed.
+ConditionPathExists=/usr/bin/docker
+
+[Service]
+Type=oneshot
+# Environment knobs — set these in
+#   ~/.config/systemd/user/mempalace-session-devbox.service.d/override.conf
+# via `systemctl --user edit mempalace-session-devbox.service`
+# (or just edit this file in place before installing).
+Environment=CONTAINER=opencode-devbox
+Environment=CONTAINER_USER=developer
+
+# Skip cleanly if the container isn't running. ExecCondition failing
+# marks the unit as "condition failed" (success from systemd's POV, no
+# alert noise). If this Condition passes, ExecStart fires.
+ExecCondition=/bin/sh -c 'docker ps --filter "name=^/${CONTAINER}$" --filter "status=running" -q | grep -q .'
+ExecStart=/usr/bin/docker exec -u ${CONTAINER_USER} ${CONTAINER} mempalace-session
+
+# Host-side log (journalctl --user -u mempalace-session-devbox --since today)
+# captures the captured stdout/stderr from the `docker exec` above.
+
+# 2h runaway ceiling — matches the in-container service unit. Enough for
+# a cold-start mine on a large corpus plus post-mine repair.
+TimeoutStartSec=7200
+
+# Low priority on the host side. The work actually happens inside the
+# container; the host-side dockerd call is negligible.
+Nice=5

contrib/systemd/mempalace-session-devbox.timer

@@ -0,0 +1,17 @@
+[Unit]
+Description=Weekly opencode-devbox → MemPalace session mine (host-scheduled)
+Documentation=https://gitea.jordbo.se/joakimp/mempalace-toolkit
+
+[Timer]
+# Every Monday at 03:00 local time. Adjust to taste.
+# See `systemctl --user list-timers mempalace-session-devbox.timer` for
+# the resolved next-run time after enabling.
+OnCalendar=Mon 03:00
+# If the host was off at the scheduled time, run at next boot.
+Persistent=true
+# Randomize up to 30 minutes to spread load if you fleet this.
+RandomizedDelaySec=30m
+AccuracySec=1m
+
+[Install]
+WantedBy=timers.target