feat: optional shared/external MemPalace + fix validate.yml false-red on base changes

Added:
- generate-config.py registers mempalace as a remote MCP endpoint when
  MEMPALACE_REMOTE_URL is set (MEMPALACE_REMOTE_TOKEN -> Bearer), else the local
  stdio command as before. Same env contract as pi-devbox's bridge.
- docker-compose.mempalace.yml: optional shared server (mempalace-mcp --transport http),
  loopback-bound by default.
- compose (both) + .env.example(.shared): MEMPALACE_REMOTE_URL/TOKEN + local-vs-external docs.

Fixed:
- validate.yml: skip validate-base/validate-omos on base-changing commits
  (base-change-warning now exports base_changed). Previously a commit that changed
  the base AND tightened smoke-test.sh in lockstep (v2.4.0 nano/micro) hard-failed
  against the stale base-latest until the release rebuilt it. actionlint clean.

README + CHANGELOG (Unreleased).

CHANGELOG.md

@@ -6,6 +6,39 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
 
 ---
 
+## Unreleased
+
+### Added
+
+- **Optional shared/external MemPalace via `MEMPALACE_REMOTE_URL`.** MemPalace
+  can now be pointed at one shared HTTP endpoint instead of each container
+  running its own local server. Set `MEMPALACE_REMOTE_URL=http://<host>:8765/mcp`
+  (optionally `MEMPALACE_REMOTE_TOKEN`, sent as `Authorization: Bearer`) in
+  `.env`; `generate-config.py` then registers the `mempalace` MCP server as a
+  `remote` endpoint instead of the local `mempalace-mcp` stdio command (no local
+  server is spawned, and the `devbox-palace` volume becomes irrelevant). Leaving
+  it unset keeps the default local-per-container palace. Mirrors the same env
+  contract as pi-devbox's `mempalace.ts` bridge, so one palace can serve pi +
+  opencode + native.
+- **`docker-compose.mempalace.yml`** — an optional shared MemPalace server
+  (`mempalace-mcp --transport http`) that several containers/harnesses can point
+  `MEMPALACE_REMOTE_URL` at. Binds to `127.0.0.1:8765` by default (the HTTP
+  transport is unauthenticated — keep it on a trusted network or behind a proxy).
+
+### Fixed
+
+- **`validate.yml` no longer reports a false failure on base-changing commits.**
+  `validate-base`/`validate-omos` build variants from the published
+  `base-latest`; when a commit changed base inputs *and* tightened
+  `smoke-test.sh` in lockstep (as v2.4.0's nano/micro did), those jobs
+  hard-failed against the still-stale `base-latest` until the release rebuilt it.
+  The `base-change-warning` job now exports a `base_changed` output and those two
+  jobs **skip** when base inputs changed, deferring full base validation to the
+  release path (`docker-publish-split.yml`). The scary red becomes a neutral skip
+  plus the existing warning.
+
+---
+
 ## v2.4.0 — 2026-07-01
 
 Minor release. Adds two **non-modal editors** (`nano` + `micro`) alongside