feat: optional shared/external MemPalace + fix validate.yml false-red on base changes

Added:
- generate-config.py registers mempalace as a remote MCP endpoint when
  MEMPALACE_REMOTE_URL is set (MEMPALACE_REMOTE_TOKEN -> Bearer), else the local
  stdio command as before. Same env contract as pi-devbox's bridge.
- docker-compose.mempalace.yml: optional shared server (mempalace-mcp --transport http),
  loopback-bound by default.
- compose (both) + .env.example(.shared): MEMPALACE_REMOTE_URL/TOKEN + local-vs-external docs.

Fixed:
- validate.yml: skip validate-base/validate-omos on base-changing commits
  (base-change-warning now exports base_changed). Previously a commit that changed
  the base AND tightened smoke-test.sh in lockstep (v2.4.0 nano/micro) hard-failed
  against the stale base-latest until the release rebuilt it. actionlint clean.

README + CHANGELOG (Unreleased).

.gitea/workflows/validate.yml

@@ -60,13 +60,19 @@ jobs:
 
   base-change-warning:
     # Surfaces a warning when this commit changes base-image inputs
-    # (Dockerfile.base, rootfs/, entrypoint*.sh). validate.yml uses
-    # Hub's base-latest as the parent for variant builds, so changes to
-    # those files are NOT exercised here — only release tags rebuild the
-    # base via docker-publish-split.yml.
+    # (Dockerfile.base, rootfs/, entrypoint*.sh) AND exports `base_changed` so
+    # validate-base/validate-omos can skip. validate.yml uses Hub's base-latest
+    # as the parent for variant builds, so a changed base is NOT exercised here
+    # — worse, if the same commit tightens smoke-test.sh in lockstep with the
+    # base change (as the nano/micro commit did), those jobs HARD-FAIL against
+    # the stale base-latest: a false red that self-heals only once the release
+    # rebuilds base-latest. So we skip them here and defer full base validation
+    # to the release path (docker-publish-split.yml on tag push).
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest
+    outputs:
+      base_changed: ${{ steps.detect.outputs.base_changed }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -74,18 +80,23 @@ jobs:
           fetch-depth: 2
 
       - name: Detect base-input changes
+        id: detect
         run: |
           set -e
-          if ! git diff --name-only HEAD~1 HEAD 2>/dev/null \
+          if git diff --name-only HEAD~1 HEAD 2>/dev/null \
               | grep -qE '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'; then
+            echo "base_changed=true" >> "$GITHUB_OUTPUT"
+            echo "::warning::This commit changes base-image inputs (Dockerfile.base, rootfs/, or entrypoint*.sh). validate.yml uses Hub's base-latest as the parent for variant builds, so the new base is NOT exercised by this workflow — validate-base/validate-omos are SKIPPED to avoid a false failure against the stale base-latest. Cut a release tag, or run a workflow_dispatch of docker-publish-split.yml against a test tag (e.g. v0.0.0-base-test, promote_latest=false) for end-to-end validation of the new base."
+            echo "Changed base-input files:"
+            git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'
+          else
+            echo "base_changed=false" >> "$GITHUB_OUTPUT"
             echo "No base-image inputs changed in this commit — validate.yml fully exercises the published base-latest."
-            exit 0
           fi
-          echo "::warning::This commit changes base-image inputs (Dockerfile.base, rootfs/, or entrypoint*.sh). validate.yml uses Hub's base-latest as the parent for variant builds, so the new base is NOT exercised by this workflow. Cut a release tag, or run a workflow_dispatch of docker-publish-split.yml against a test tag (e.g. v0.0.0-base-test, promote_latest=false) for end-to-end validation of the new base."
-          echo "Changed base-input files:"
-          git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile\.base|rootfs/|entrypoint.*\.sh)$'
 
   validate-base:
+    needs: [base-change-warning]
+    if: ${{ needs.base-change-warning.outputs.base_changed != 'true' }}
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest
@@ -147,6 +158,8 @@ jobs:
           bash scripts/smoke-test.sh opencode-devbox:ci-base --variant base
 
   validate-omos:
+    needs: [base-change-warning]
+    if: ${{ needs.base-change-warning.outputs.base_changed != 'true' }}
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest