v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

CHANGELOG.md

@@ -8,6 +8,80 @@ Tags follow `v{opencode_version}[letter]` — bare tag for the first build on a
 
 ## Unreleased
 
+## v2.0.0 — 2026-06-13
+
+**Major release: pi is fully removed from opencode-devbox** (deprecated in
+v1.17.2), and the user-writable global npm prefix is relocated off the
+pi-specific `~/.pi` path. Also bumps opencode. The major version signals the
+two breaking changes below.
+
+### Bumped: opencode-ai 1.17.2 → 1.17.4
+
+`OPENCODE_VERSION` ARG in `Dockerfile.variant`.
+
+### Removed: all pi support
+
+pi ships as its own self-contained image,
+[`joakimp/pi-devbox`](https://gitea.jordbo.se/joakimp/pi-devbox). Everything
+pi-related is now gone from this repo:
+
+- The `INSTALL_PI` build arg and all `PI_*` args (`PI_VERSION`,
+  `PI_TOOLKIT_REF`, `PI_EXTENSIONS_REF`, `PI_FORK_*`, `PI_OBSMEM_*`).
+- The `with-pi`, `omos-with-pi`, and `pi-only` build variants. **Only `base`
+  and `omos` remain** — four published tags per release (`vX.Y.Z`, `latest`,
+  `vX.Y.Z-omos`, `latest-omos`).
+- The `base-pi-only[-vX.Y.Z]` tag that this repo's CI published into the
+  `joakimp/pi-devbox` repo. The publisher job is deleted; the orphaned
+  `base-pi-only*` tags on the pi-devbox Hub repo can now be purged (see
+  `docs/CLEANUP-v2.0.0.md`).
+- All `~/.pi` entrypoint wiring (pi-toolkit / pi-extensions deploy,
+  settings.json bootstrap, mempalace pi-bridge symlink, pi-fork / pi-obsmem
+  registration), the `~/.pi` volume-ownership entry, and the three pi
+  smoke / validate / build-variant CI jobs.
+
+**Migration:** pull `joakimp/pi-devbox:latest` instead of any `*-with-pi` /
+`pi-only` opencode-devbox tag. opencode-only users are unaffected by the pi
+removal itself.
+
+### Breaking: global npm prefix relocated `~/.pi/npm-global` → `~/.config/opencode/npm-global`
+
+`NPM_CONFIG_PREFIX` (and the matching `PATH` entry) moved off the
+pi-specific path. The new location lives on the `devbox-opencode-config`
+named volume, which — unlike the old `devbox-pi-config` — is a **persistent
+named volume in both `docker-compose.yml` and `docker-compose.shared.yml`**,
+so runtime `npm install -g` still survives container recreate and image
+rebuild.
+
+**Impact on upgraders:** any tool you previously `npm install -g`'d landed in
+`~/.pi/npm-global` and will **drop off `PATH`** under v2.0.0.
+
+**Mitigation (automatic):** `entrypoint-user.sh` carries a one-time
+migration shim. On first start, if `~/.pi/npm-global` exists and the marker
+`~/.config/opencode/npm-global/.migrated-from-dot-pi` is absent, it copies
+the old `lib/`/`bin/`/`share/` contents into the new prefix (never
+overwriting freshly-installed packages) and writes the marker. For the shim
+to see your old packages, the legacy `devbox-pi-config` volume must still be
+mounted at `~/.pi` for that first start — the shipped `docker-compose.yml`
+leaves it commented with instructions; uncomment the mount for one start if
+you had global npm tools to migrate, then remove it. Fresh installs carry no
+`~/.pi` dead weight. If you don't need the old packages, ignore all of this
+and re-`npm install -g` anything you want.
+
+### Docs / CI
+
+- `DOCKER_HUB.md` now shows the baked opencode version via a
+  `{{OPENCODE_VERSION}}` placeholder substituted by CI at publish time
+  (mirrors pi-devbox's `{{PI_VERSION}}` pattern) — the Hub page can no longer
+  drift from the image.
+- README, AGENTS.md, `.gitea/README.md`, `.env.example`, and the
+  `docs/manual-host-publish.*` runbook updated to the two-variant reality
+  (variant tables, CI job lists, the npm-prefix gotcha, ASCII pipeline
+  diagram, tag counts).
+- CI: removed the three pi smoke jobs, three pi build-variant jobs, the
+  `pi-only` publish-to-pi-devbox job, and the pi/fork/obsmem resolution in
+  `resolve-versions` (now resolves omos only). `validate.yml` drops its
+  three pi validate jobs.
+
 ## v1.17.2 — 2026-06-10
 
 First container build on **opencode-ai `1.17.2`** (from `1.16.2`). This