Auto-detect username for volume isolation in own-account mode

The previous SIGNUM variable was required (${SIGNUM:?...}), which
broke for users with their own OS accounts who shouldn't need to set
anything manually. Replace with ${SIGNUM:-${USER}} so:

- Own-account mode: leave SIGNUM unset in .env — project name and
  container name default to devbox-$USER automatically. Each OS
  user gets isolated volumes with zero configuration.
- Shared-account mode: set SIGNUM=<id> in .env as before.

Both container_name and the top-level name: field use the same
fallback, so volumes and container names stay consistent.

Updated .env.shared.example to document both modes with the SIGNUM
line commented out by default (own-account is the common case).

.env.shared.example

@@ -1,7 +1,13 @@
 # ── Shared machine setup ─────────────────────────────────────────────
-# Your corporate signum / username (REQUIRED)
+# SIGNUM isolates your container name and named volumes from other users.
-# This isolates your container, config, and data from other users.
+#
-SIGNUM=your-signum-here
+# Own-account mode (each user has their own OS login):
+#   Leave SIGNUM commented out — it defaults to your OS username ($USER).
+# SIGNUM=
+#
+# Shared-account mode (everyone logs in as the same OS user):
+#   Uncomment and set to your unique identifier.
+# SIGNUM=your-signum-here
 
 # ── Provider ─────────────────────────────────────────────────────────
 OPENCODE_PROVIDER=amazon-bedrock

docker-compose.shared.yml

@@ -12,18 +12,24 @@
 #   5. mkdir -p ~/<signum>/.config/opencode
 #   6. docker compose up -d
 #
-# Volume isolation: the top-level 'name:' field uses SIGNUM to derive a
+# Volume isolation: the top-level 'name:' field derives a unique project
-# unique project name (devbox-<signum>), which Docker Compose uses as the
+# name per user, which Docker Compose uses as the prefix for all named
-# prefix for all named volumes. Without this, two users whose compose file
+# volumes. Without this, two users whose compose file lives in a directory
-# lives in a directory with the same basename would share volumes — the
+# with the same basename would share volumes — the Docker daemon is
-# Docker daemon is system-wide and doesn't scope by OS user.
+# system-wide and doesn't scope by OS user.
+#
+# Two modes:
+#   Own-account mode (each user has their own OS login):
+#     Leave SIGNUM unset in .env — it defaults to $USER automatically.
+#   Shared-account mode (everyone logs in as the same OS user):
+#     Set SIGNUM=<unique-id> in .env so each person gets isolated volumes.
 
-name: devbox-${SIGNUM:?Set SIGNUM in .env}
+name: devbox-${SIGNUM:-${USER}}
 
 services:
   devbox:
     image: joakimp/opencode-devbox:latest
-    container_name: devbox-${SIGNUM:?Set SIGNUM in .env}
+    container_name: devbox-${SIGNUM:-${USER}}
     stdin_open: true
     tty: true
     env_file: