feat: add yq, pandoc, graphviz, tldr (tealdeer) + dot-watch — CLI parity with pi-devbox

- apt: yq (YAML query), pandoc (doc converter), graphviz (dot rendering)
- tealdeer: tldr command as ~5MB static musl binary (TEALDEER_VERSION arg)
- dot-watch: auto-render .dot to PNG on save (graphviz-only, no imagemagick)
- README: document new tools
- smoke-test: presence assertions for yq, pandoc, dot, tldr, dot-watch

Excludes socat, imagemagick, studio-expose (pi-studio-specific).

README.md

@@ -835,7 +835,11 @@ Container (Debian trixie)
 ├── oh-my-opencode-slim (optional — multi-agent orchestration plugin, includes Bun)
 ├── AWS CLI v2 (SSO + Bedrock auth)
 ├── neovim 0.12, nano, micro, tmux, htop, bat, eza, zoxide, uv, rustup, make, gcc, g++, rsync
-├── git, git-crypt, age, gitleaks, ssh, ripgrep, fd, fzf, jq, curl, tree
+├── git, git-crypt, age, gitleaks, ssh, ripgrep, fd, fzf, jq, yq, curl, tree
+├── pandoc (Markdown↔HTML/PDF/etc. conversion)
+├── graphviz (dot diagram rendering)
+├── tldr (tealdeer — quick command examples)
+├── dot-watch (auto-render .dot to PNG on save)
 ├── Node.js (for MCP servers)
 ├── Bun (optional — included with oh-my-opencode-slim)
 ├── entrypoint.sh (UID adjustment, git config, provider setup)