feat: optional shared/external MemPalace + fix validate.yml false-red on base changes

Added:
- generate-config.py registers mempalace as a remote MCP endpoint when
  MEMPALACE_REMOTE_URL is set (MEMPALACE_REMOTE_TOKEN -> Bearer), else the local
  stdio command as before. Same env contract as pi-devbox's bridge.
- docker-compose.mempalace.yml: optional shared server (mempalace-mcp --transport http),
  loopback-bound by default.
- compose (both) + .env.example(.shared): MEMPALACE_REMOTE_URL/TOKEN + local-vs-external docs.

Fixed:
- validate.yml: skip validate-base/validate-omos on base-changing commits
  (base-change-warning now exports base_changed). Previously a commit that changed
  the base AND tightened smoke-test.sh in lockstep (v2.4.0 nano/micro) hard-failed
  against the stale base-latest until the release rebuilt it. actionlint clean.

README + CHANGELOG (Unreleased).

rootfs/usr/local/lib/opencode-devbox/generate-config.py

@@ -16,9 +16,13 @@ Environment variables:
   OPENCODE_MODEL     Optional. Overrides the provider default model.
   AWS_REGION         Bedrock only. Default: us-east-1.
   AWS_PROFILE        Bedrock only. Default: default.
+  MEMPALACE_REMOTE_URL    Optional. Point MemPalace at a shared HTTP endpoint
+                          instead of spawning a local stdio server.
+  MEMPALACE_REMOTE_TOKEN  Optional. Bearer token for MEMPALACE_REMOTE_URL.
 
 MCP servers are auto-registered for tools detected on PATH:
-  - mempalace (if installed) — enabled
+  - mempalace — LOCAL stdio if `mempalace-mcp` is installed, or EXTERNAL
+    (remote HTTP) when MEMPALACE_REMOTE_URL is set (shared palace)
   - gitea-mcp (if installed) — registered but disabled by default
 
 Output path: $HOME/.config/opencode/opencode.jsonc
@@ -80,13 +84,27 @@ def register_mcp_servers(config: dict) -> list[str]:
     """
     servers: dict[str, dict] = {}
 
-    # MemPalace — local-first AI memory (if installed).
-    # `mempalace-mcp` is the entry-point binary shipped by the mempalace
-    # Python package. `uv tool install mempalace` places it on PATH as a
-    # shim whose shebang points at the isolated venv's Python, so system
-    # `python3 -m mempalace.mcp_server` (which would fail — system
-    # python3 can't import from the uv venv) is unnecessary here.
-    if shutil.which("mempalace-mcp"):
+    # MemPalace — AI memory. Two modes, same env contract as the mempalace.ts
+    # pi extension (mempalace-toolkit), so one shared MemPalace can serve pi +
+    # opencode + native:
+    #   LOCAL (default): stdio subprocess. `mempalace-mcp` is the entry-point
+    #     binary shipped by the mempalace Python package. `uv tool install
+    #     mempalace` places it on PATH as a shim whose shebang points at the
+    #     isolated venv's Python, so system `python3 -m mempalace.mcp_server`
+    #     (which would fail — system python3 can't import from the uv venv) is
+    #     unnecessary here.
+    #   EXTERNAL: set MEMPALACE_REMOTE_URL to a shared MemPalace HTTP endpoint
+    #     (e.g. http://mempalace.lan:8765/mcp). MEMPALACE_REMOTE_TOKEN, if set,
+    #     becomes a Bearer auth header. No local mempalace-mcp is spawned, so
+    #     the binary need not even be installed in this mode.
+    remote_url = os.environ.get("MEMPALACE_REMOTE_URL", "").strip()
+    if remote_url:
+        entry: dict = {"type": "remote", "url": remote_url}
+        token = os.environ.get("MEMPALACE_REMOTE_TOKEN", "").strip()
+        if token:
+            entry["headers"] = {"Authorization": f"Bearer {token}"}
+        servers["mempalace"] = entry
+    elif shutil.which("mempalace-mcp"):
         servers["mempalace"] = {
             "type": "local",
             "command": ["mempalace-mcp"],