feeder: default agent to pi@<device> so palace writes carry provenance

mempalace core 3.7.1 records neither which machine nor which harness produced a
drawer, and the single shared bearer token means the server cannot distinguish
clients. Today both facts survive only incidentally -- device in the per-device
inbox path, harness in the pi_*.jsonl filename -- so attribution for anything
filed outside the feeder has to be inferred after the fact.

Defaulting --agent to pi@$MEMPALACE_PI_DEVICE records both explicitly in a field
that already flows through to drawer metadata (added_by), for every enrolled
device, with no core change. Falls back to $USER, which is what pre-existing
drawers carry (added_by=joakim on fed transcripts, hence the ambiguity).

Not pushed: lands on machines at the next image build.

bin/mempalace-pi-session

@@ -135,7 +135,16 @@ set -euo pipefail
 export HOME
 
 # ── Defaults ─────────────────────────────────────────────────────────
-AGENT="${USER:-mempalace}"
+# Agent name defaults to "<harness>@<device>" when the device is known
+# (MEMPALACE_PI_DEVICE is set on every enrolled devbox). That one string is the
+# only place a palace write records BOTH which harness produced it and which
+# machine it came from: mempalace core 3.7.1 stamps neither, and because every
+# client shares one bearer token the server cannot tell them apart either. The
+# per-device inbox path and the pi_*.jsonl filename encode the same two facts
+# only incidentally, so anything filed outside the feeder had to be inferred.
+# Falls back to $USER — which is what every drawer filed before this carries.
+AGENT="${MEMPALACE_PI_DEVICE:+pi@${MEMPALACE_PI_DEVICE}}"
+AGENT="${AGENT:-${USER:-mempalace}}"
 WING="wing_conversations"
 SESSION_ID=""
 SINCE=""