Pre-warm chromadb embedding model at build time

Mempalace's embedding function is chromadb's ONNXMiniLM_L6_V2, which
downloads ~80 MB of all-MiniLM-L6-v2 ONNX weights from chromadb's CDN
on first use. Without pre-warming this happened silently in the
entrypoint init step (output redirected to /dev/null) and stalled
first container start by multiple minutes on slow networks — the
symptom user reported as 'hangs at Initializing MemPalace for
workspace'.

Fix: invoke the embedding function once at build time as gosu
developer so the cache lands at the runtime user's
~/.cache/chroma/onnx_models/all-MiniLM-L6-v2/ with correct ownership
and survives container recreate (cache path is not on a named
volume, so it lives in the image layer).

Build-time cost: ~3-5 s to download. Runtime saving: minutes per
fresh container.

Image size: 2110 → 2277 MB for the with-pi variant. Still within
the 2700 MB smoke-test threshold.

Dockerfile

@@ -398,6 +398,26 @@ RUN mkdir -p /workspace \
     /home/${USER_NAME}/.ssh && \
     chown -R ${USER_NAME}:${USER_NAME} /workspace /home/${USER_NAME}
 
+# ── Pre-warm chromadb embedding model ──────────────────────────────
+# Mempalace uses chromadb's ONNXMiniLM_L6_V2 embedding function, which
+# downloads ~80 MB of all-MiniLM-L6-v2 ONNX weights from chromadb's CDN
+# on first use. Without pre-warming this happens silently (output is
+# suppressed by the entrypoint init step) and stalls first container
+# start by minutes on a slow network. We bake the cache at build time
+# under the developer user's home so the runtime first-start is fast.
+#
+# Cache path comes from chromadb's hardcoded `Path.home() / .cache /
+# chroma / onnx_models / all-MiniLM-L6-v2`. Run as gosu developer so
+# Path.home() resolves correctly and ownership is right from the start.
+RUN if [ "${INSTALL_MEMPALACE}" = "true" ]; then \
+      gosu ${USER_NAME} /opt/uv-tools/mempalace/bin/python -c "\
+from chromadb.utils.embedding_functions import ONNXMiniLM_L6_V2; \
+ef = ONNXMiniLM_L6_V2(); \
+_ = ef(['warmup']); \
+print('chromadb embedding model warmed: all-MiniLM-L6-v2')" && \
+      ls -lh /home/${USER_NAME}/.cache/chroma/onnx_models/all-MiniLM-L6-v2/ ; \
+    fi
+
 # ── Shell defaults (bash history, aliases, readline) ─────────────────
 # Shipped under /etc/skel-devbox/ rather than copied directly to the
 # user's home. The entrypoint copies them to /home/developer/ only if