v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

docker-compose.yml

@@ -25,8 +25,6 @@ services:
     #   args:
     #     INSTALL_GO: "false"
     #     INSTALL_OMOS: "false"
-    #     INSTALL_PI: "false"
-    #     # PI_VERSION: "latest"
     #     # INSTALL_OPENCODE: "true"
     container_name: opencode-devbox
     stdin_open: true
@@ -58,7 +56,13 @@ services:
       # the container's skill/instruction symlinks independent from the host,
       # allowing both native and containerized opencode on the same machine.
       - devbox-opencode-config:/home/developer/.config/opencode
-      - devbox-pi-config:/home/developer/.pi
+      # Legacy pi config volume (pi was removed in v2.0.0). Left commented so
+      # fresh installs carry no dead weight. If you are UPGRADING from a
+      # pre-v2.0.0 image and had global npm packages installed via
+      # `npm install -g` (they lived under ~/.pi/npm-global), uncomment this
+      # for ONE container start: entrypoint-user.sh's migration shim copies
+      # them to ~/.config/opencode/npm-global, after which you can remove it.
+      # - devbox-pi-config:/home/developer/.pi
       # Persist the generated LAN-jump keypair (~/.ssh-local) across recreates.
       # setup-lan-access.sh generates this key once and reuses it; persisting
       # it means you authorize it on the host ONCE rather than re-authorizing
@@ -138,7 +142,7 @@ services:
 
 volumes:
   devbox-opencode-config:
-  devbox-pi-config:
+  # devbox-pi-config:  # legacy (pi removed v2.0.0) — uncomment with the mount above only to migrate old global npm packages
   devbox-ssh-local:
   devbox-data:
   devbox-state: