v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

Dockerfile.base

@@ -1,15 +1,14 @@
 # opencode-devbox — base image (variant-independent layers)
 #
 # This Dockerfile produces an image tagged base-<hash>, used as the parent
-# for all four published variants (base, omos, with-pi, omos-with-pi).
-# It contains everything that does not depend on variant-specific
-# build-args (INSTALL_OPENCODE, INSTALL_OMOS, INSTALL_PI). The variant
-# Dockerfile (Dockerfile.variant) FROMs the base and adds only those
-# deltas.
+# for all published variants (base, omos). It contains everything that
+# does not depend on variant-specific build-args (INSTALL_OPENCODE,
+# INSTALL_OMOS). The variant Dockerfile (Dockerfile.variant) FROMs the
+# base and adds only those deltas.
 #
 # The base is rebuilt only when this file or anything it COPYs in
 # changes (rootfs/, entrypoint*.sh). Version bumps to OPENCODE_VERSION,
-# OMOS_VERSION, PI_VERSION, etc. do NOT trigger a base rebuild.
+# OMOS_VERSION, etc. do NOT trigger a base rebuild.
 #
 # To force a base rebuild for fresh apt packages without other code
 # changes, bump the BASE_REBUILD_DATE comment below. The hash is
@@ -375,7 +374,7 @@ RUN groupadd --gid ${USER_GID} ${USER_NAME} && \
 # Create standard directories
 RUN mkdir -p /workspace \
     /home/${USER_NAME}/.config/opencode/skills \
-    /home/${USER_NAME}/.pi/agent/extensions \
+    /home/${USER_NAME}/.config/opencode/npm-global \
     /home/${USER_NAME}/.agents/skills \
     /home/${USER_NAME}/.local/share/opencode \
     /home/${USER_NAME}/.cache/bash \
@@ -395,20 +394,28 @@ print('chromadb embedding model warmed: all-MiniLM-L6-v2')" && \
       ls -lh /home/${USER_NAME}/.cache/chroma/onnx_models/all-MiniLM-L6-v2/ ; \
     fi
 
-# ── User-writable npm global prefix on the devbox-pi-config volume ──
+# ── User-writable npm global prefix on the devbox-opencode-config volume ──
 # By default npm's global prefix is /usr (writable only by root) so any
-# `pi install npm:<pkg>` or `npm install -g <pkg>` invoked by the
-# developer user would EACCES. Pointing the prefix into ~/.pi places
-# user-installed packages on the named volume, which means they survive
-# container recreation AND image rebuilds.
+# `npm install -g <pkg>` invoked by the developer user would EACCES.
+# Pointing the prefix into ~/.config/opencode places user-installed
+# packages on the devbox-opencode-config named volume, which means they
+# survive container recreation AND image rebuilds.
+#
+# NOTE (v2.0.0): this prefix previously lived at ~/.pi/npm-global — a
+# pi-specific path. With pi removed (see docs/CLEANUP-v2.0.0.md) it now
+# lives under ~/.config/opencode, which is a persistent named volume in
+# BOTH docker-compose.yml and docker-compose.shared.yml (the old ~/.pi
+# volume was only in the former). A one-time migration shim in
+# entrypoint-user.sh copies any existing ~/.pi/npm-global contents to the
+# new prefix on first start so user-installed globals are not lost.
 #
 # IMPORTANT: in this split-build layout the variant Dockerfile inherits
 # this prefix at build time. To keep the baked binaries on /usr (so the
-# ~/.pi volume mount doesn't shadow them), the variant Dockerfile MUST
-# run each `npm install -g` with NPM_CONFIG_PREFIX=/usr in the per-RUN
+# volume mount doesn't shadow them), the variant Dockerfile MUST run each
+# `npm install -g` with NPM_CONFIG_PREFIX=/usr in the per-RUN
 # environment. See Dockerfile.variant.
-ENV NPM_CONFIG_PREFIX=/home/${USER_NAME}/.pi/npm-global
-ENV PATH="/home/${USER_NAME}/.pi/npm-global/bin:${PATH}"
+ENV NPM_CONFIG_PREFIX=/home/${USER_NAME}/.config/opencode/npm-global
+ENV PATH="/home/${USER_NAME}/.config/opencode/npm-global/bin:${PATH}"
 
 # ── Shell defaults (bash history, aliases, readline) ─────────────────
 RUN mkdir -p /etc/skel-devbox