feat: pi-devbox parity — typst PDF, terminal terminfo, nvim colour, host-ssh check, hygiene

Ports the base additions from pi-devbox v1.4.0 + v1.5.0 that opencode-devbox
lacked (opencode-devbox already tracks pi-devbox for CLI-toolset parity, v2.6.0):

- typst PDF engine for pandoc (v1.4.0) + the pandoc typst-template default-font
  patch (v1.5.0) so 'pandoc --pdf-engine=typst' works without -V mainfont.
  pandoc shipped since v2.6.0 as a front-end only (no PDF back-end). +xz-utils.
  Tracks latest; --build-arg TYPST_VERSION escape hatch.
- Terminal support (v1.5.0): ncurses-term + kitty-terminfo + a compiled
  xterm-ghostty alias (tic -x, use=ghostty), so wezterm/alacritty/foot/ghostty/
  kitty resolve TERM over SSH instead of degrading to a dumb fallback.
- Readable Neovim colours (v1.5.0): system-wide /etc/xdg/nvim/sysinit.vim with
  termguicolors.
- Host SSH reachability check at shell startup (v1.4.0): one-time probe in
  .bash_aliases warning (with fix steps + inline pubkey) when the Mac host is
  unreachable. The rest of the LAN stack was already present.
- .claude/settings.local.json added to the gitignore_global seed (v1.5.0).
- Repo hygiene (v1.5.0): LICENSE (MIT), THIRD_PARTY.md, hadolint CI job (pinned
  v2.14.0) + .hadolint.yaml, IDEAS.md backlog.

Base-affecting (Dockerfile.base + rootfs) → base-<hash> advances, base rebuilds.
smoke-test gains typst/PDF, terminfo, and nvim-tgc assertions. Validated:
hadolint clean on both Dockerfiles, bash -n OK, base-hash guard OK, workflow
guard OK. CHANGELOG v2.7.0.

CHANGELOG.md

@@ -6,6 +6,82 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
 
 ---
 
+## v2.7.0 — 2026-07-13
+
+Minor release. Headline: **further parity with the sibling `pi-devbox` image** —
+ports the base additions from pi-devbox v1.4.0 + v1.5.0 that opencode-devbox
+lacked. **PDF export now works out of the box** (`typst` as the pandoc PDF
+engine — pandoc shipped since v2.6.0 as a front-end only), modern terminal
+emulators resolve their `TERM` over SSH (ncurses-term + kitty-terminfo + a
+compiled `xterm-ghostty` alias), Neovim renders in readable 24-bit colour by
+default, and a first-shell **host SSH reachability check** warns when the Mac
+host isn't reachable. Also adds repository hygiene (LICENSE, THIRD_PARTY.md,
+hadolint CI, IDEAS backlog) and a `.claude` gitignore-seed pattern. All the
+tooling/rootfs changes are base-affecting, so `base-<hash>` advances and the
+base rebuilds.
+
+### Added
+
+- **`typst` — PDF engine for pandoc (Markdown→PDF).** `pandoc` shipped in the
+  base since v2.6.0 but as a front-end only — with no PDF back-end,
+  `pandoc -o out.pdf` failed with "xelatex not found". The base now installs
+  `typst`, a single ~30 MB static Rust binary (no LaTeX), used via
+  `pandoc --pdf-engine=typst`; a fuller TeX Live remains the higher-fidelity
+  fallback (install on demand). Also patches pandoc's bundled typst template
+  (`/usr/share/pandoc/data/templates/template.typst`), whose empty `font: ()`
+  default otherwise made a naked `--pdf-engine=typst` fail with "font fallback
+  list must not be empty" — defaulted to `Libertinus Serif` so PDF export works
+  without `-V mainfont`. Adds `xz-utils` to the apt layer (typst ships a
+  `.tar.xz`). Tracks `latest`; pin with `--build-arg TYPST_VERSION=vX.Y.Z`.
+  Ported from pi-devbox v1.4.0 (+ its v1.5.0 font-default fix). Base-affecting.
+
+- **Terminal support beyond the default: `ncurses-term` + `kitty-terminfo` + a
+  compiled `xterm-ghostty` alias.** The base previously shipped only
+  `ncurses-base`, so SSHing in from a modern emulator degraded to a dumb
+  fallback. Now installs `ncurses-term` (terminfo for WezTerm, Alacritty, foot,
+  st, the base `ghostty` entry, and many more) and `kitty-terminfo`
+  (`xterm-kitty`), and compiles an `xterm-ghostty` alias with `tic -x`
+  (`use=ghostty`) — Ghostty connects as `TERM=xterm-ghostty` and no distro
+  packages that name. iTerm2's `xterm-256color` is already in ncurses-base. New
+  `rootfs/usr/local/share/terminfo-src/ghostty.terminfo`; the build asserts the
+  entry landed via `infocmp`. Ported from pi-devbox v1.5.0. Base-affecting.
+
+- **Readable Neovim colours out of the box.** New system-wide Neovim config
+  (`rootfs/etc/xdg/nvim/sysinit.vim`) enables `termguicolors`. Vanilla Neovim
+  otherwise fell back to a muddy, low-contrast 256-colour palette over ssh.
+  `sysinit.vim` is Neovim's system vimrc — it loads for every user before any
+  personal `~/.config/nvim` and can still be overridden per-user
+  (`:set notermguicolors`). Pairs with `kitty-terminfo` above. Ported from
+  pi-devbox v1.5.0. Base-affecting.
+
+- **Host SSH reachability check at shell startup.** `~/.bash_aliases` (baked
+  into the base) now runs a one-time SSH probe on the first bash session of each
+  container. If the Mac host is not reachable (Remote Login disabled or the
+  `devbox_jump` key not yet authorized) it prints a clear warning with the exact
+  two steps to fix it, including the container's public key inline. Subsequent
+  shells skip the check (a `/tmp` flag cleared on recreate); silent when SSH
+  works. Complements the existing `setup-lan-access.sh` key-generation message.
+  Ported from pi-devbox v1.4.0. Base-affecting.
+
+- **Seeded global gitignore now ignores `**/.claude/settings.local.json`.**
+  Claude Code's per-machine local settings file holds machine-specific
+  permissions and can carry credentials, so it should never be committed. The
+  seed (`rootfs/home/developer/.gitignore_global`, baked to `/etc/skel-devbox/`)
+  gains the pattern. Existing containers are unaffected (the seed is copied only
+  when `~/.gitignore_global` is absent). Base-affecting (rootfs COPY).
+
+- **Repository hygiene: `LICENSE`, `THIRD_PARTY.md`, `hadolint` CI, `IDEAS.md`.**
+  The repo declared MIT only in prose; it now ships an actual `LICENSE` file
+  (MIT, © Joakim Persson) plus `THIRD_PARTY.md` recording that the published
+  images bundle third-party software under its own terms (opencode, OMOS,
+  mempalace — MIT; gosu/uv/typst Apache-2.0; Debian packages under their own
+  licenses). A new `hadolint` job (pinned v2.14.0) in the lint workflow lints
+  `Dockerfile.base` and `Dockerfile.variant`; `.hadolint.yaml` grandfathers the
+  deliberate choices (unpinned apt/npm, `cd`-in-`RUN`, `SC2086` — mirroring the
+  existing shellcheck excludes) and fails on anything new at `warning`+.
+  `IDEAS.md` parks vetted-but-unscheduled follow-ups. Repo/CI only — not baked
+  into the image.
+
 ## v2.6.0 — 2026-07-08
 
 Minor release. Headline: **CLI-toolset parity with the sibling `pi-devbox`