v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

docs/manual-host-publish.md

@@ -29,14 +29,11 @@ cp docs/manual-host-publish.sh /tmp/manual-publish-vX.Y.Z.sh
 # Edit at top of file:
 #   RELEASE_TAG="vX.Y.Z"
 #   BASE_HASH="<12-char hash from CI's base-decide step>"
-#   PI_VERSION="<from npm registry, see step 2 below>"
 #   OMOS_VERSION="<from npm registry, see step 2 below>"
 bash /tmp/manual-publish-vX.Y.Z.sh
 ```
 
-Keep the historical script in `docs/` as-is — it's an archive of the v1.15.12 publish, useful as a reference if a future debug needs to compare exact arg sets across releases. Don't edit it in place.
-
-The sections below explain what the script does and what you need to know to edit those four constants safely.
+The sections below explain what the script does and what you need to know to edit those three constants safely.
 
 ## 1. Pin RELEASE_TAG
 
@@ -49,16 +46,15 @@ git describe --tags --exact-match HEAD
 
 The script asserts `HEAD == ${RELEASE_TAG}^{commit}` before doing anything destructive. If you've drifted, fix it with `git checkout` before running.
 
-## 2. Pin PI_VERSION and OMOS_VERSION
+## 2. Pin OMOS_VERSION
 
-Gitea CI's `resolve-versions` job queries the npm registry at workflow time and threads concrete versions through every variant build, mitigating the silent same-bytes-across-releases regression class documented in `AGENTS.md`. Do the same by hand:
+Gitea CI's `resolve-versions` job queries the npm registry at workflow time and threads the concrete version through the omos variant build, mitigating the silent same-bytes-across-releases regression class documented in `AGENTS.md`. Do the same by hand:
 
 ```bash
-curl -sf https://registry.npmjs.org/@earendil-works%2Fpi-coding-agent/latest | jq -r .version
 curl -sf https://registry.npmjs.org/oh-my-opencode-slim/latest | jq -r .version
 ```
 
-Paste the two version strings into the script's `PI_VERSION` / `OMOS_VERSION` constants. Don't leave the script defaulting to `latest` — the registry buildcache will silently reuse a stale layer if the build-arg byte-equals a previous build.
+Paste the version string into the script's `OMOS_VERSION` constant. Don't leave the script defaulting to `latest` — the registry buildcache will silently reuse a stale layer if the build-arg byte-equals a previous build.
 
 ## 3. Pin BASE_HASH
 
@@ -101,8 +97,8 @@ After the constants are set, the script runs a 5-step procedure. No editing need
 1. **Preflight** — buildx present, tag exists, `HEAD == tag`, multi-arch builder created if missing.
 2. **Base build (conditional)** — probe `${IMAGE}:base-${BASE_HASH}` on the Hub; if missing, build it multi-arch and push. **No `--cache-from` / `--cache-to`.** That's the whole point of this escape. If the base push itself fails the same way CI did, stop — the regression has spread to image push and you need a different host or account, not this runbook.
 3. **Promote `base-latest`** — `docker buildx imagetools create` re-tags by manifest reference. No rebuild.
-4. **Variants × 5** — sequential (not parallel; one host's egress can't saturate five multi-arch pushes safely). Each variant is `Dockerfile.variant` `FROM ${IMAGE}:base-${BASE_HASH}` plus the appropriate `INSTALL_OPENCODE` / `INSTALL_OMOS` / `INSTALL_PI` build-args, tagged `${RELEASE_TAG}${suffix}` and `latest${suffix}`.
-5. **Verify** — prints the digest of all 12 expected tags (10 variant + base-hash + base-latest). Spot-check that each `vX.Y.Z*` and its `latest*` alias share a digest.
+4. **Variants × 2** — sequential (not parallel; one host's egress can't saturate multiple multi-arch pushes safely). Each variant is `Dockerfile.variant` `FROM ${IMAGE}:base-${BASE_HASH}` plus the appropriate `INSTALL_OPENCODE` / `INSTALL_OMOS` build-args, tagged `${RELEASE_TAG}${suffix}` and `latest${suffix}`.
+5. **Verify** — prints the digest of all 6 expected tags (4 variant + base-hash + base-latest). Spot-check that each `vX.Y.Z*` and its `latest*` alias share a digest.
 
 Expected wall time on a recent Mac: ~25-40 min (base ~3 min if rebuilt, each variant ~3-7 min mostly QEMU arm64 emulation).
 

docs/manual-host-publish.sh

@@ -1,35 +1,34 @@
 #!/usr/bin/env bash
-# Manual publish of opencode-devbox v1.15.12 — bypasses broken Gitea-runner
-# Hub push by building & pushing from a developer host (Orbstack/Docker Desktop).
+# Manual publish of opencode-devbox — bypasses a broken Gitea-runner Hub push
+# by building & pushing from a developer host (Orbstack/Docker Desktop).
 #
 # Mirrors what .gitea/workflows/docker-publish-split.yml would do:
 #   1. Build & push Dockerfile.base    → joakimp/opencode-devbox:base-<hash>
 #   2. Promote                         → joakimp/opencode-devbox:base-latest
-#   3. Build & push 5 variants on top of base-<hash>:
-#        :v1.15.12              :latest              (INSTALL_OPENCODE only)
-#        :v1.15.12-omos         :latest-omos         (+ OMOS)
-#        :v1.15.12-with-pi      :latest-with-pi      (+ pi)
-#        :v1.15.12-omos-with-pi :latest-omos-with-pi (+ both)
-#        :v1.15.12-pi-only      :latest-pi-only      (pi, no opencode)
+#   3. Build & push 2 variants on top of base-<hash>:
+#        :vX.Y.Z              :latest              (INSTALL_OPENCODE only)
+#        :vX.Y.Z-omos         :latest-omos         (+ OMOS)
+#
+# pi was removed in v2.0.0 — there are no pi variants here anymore.
 #
 # Usage on your host:
 #   1. Make sure Orbstack/Docker Desktop is running with multi-arch enabled
 #      (docker buildx ls should show linux/amd64,linux/arm64).
 #   2. docker login docker.io   (joakimp account)
-#   3. cd ~/path/to/opencode-devbox && git fetch && git checkout v1.15.12
-#   4. bash /path/to/this/script.sh
+#   3. cd ~/path/to/opencode-devbox && git fetch && git checkout <RELEASE_TAG>
+#   4. Edit RELEASE_TAG / BASE_HASH / OMOS_VERSION below to match the release.
+#   5. bash /path/to/this/script.sh
 #
-# Total expected time: ~25-40 min on a recent Mac (4 multi-arch builds, base
+# Total expected time: ~15-25 min on a recent Mac (2 multi-arch builds, base
 # layers cache after the first variant).
 
 set -euo pipefail
 
 IMAGE="joakimp/opencode-devbox"
-RELEASE_TAG="v1.15.12"
-BASE_HASH="8d72a9e44796"        # sha256 of Dockerfile.base + rootfs/* + entrypoints (computed by CI logic)
+RELEASE_TAG="v2.0.0"            # EDIT per release
+BASE_HASH="REPLACE_ME"          # sha256 of Dockerfile.base + rootfs/* + entrypoints (computed by CI logic)
 BASE_TAG="base-${BASE_HASH}"
-PI_VERSION="0.76.0"             # resolved from npm @earendil-works/pi-coding-agent latest (2026-05-28)
-OMOS_VERSION="1.1.1"            # resolved from npm oh-my-opencode-slim latest (2026-05-28)
+OMOS_VERSION="latest"           # resolve from npm oh-my-opencode-slim latest, then pin
 PLATFORMS="linux/amd64,linux/arm64"
 
 # -------- preflight --------
@@ -65,14 +64,12 @@ fi
 echo "==> [2/7] Promote ${IMAGE}:${BASE_TAG} → ${IMAGE}:base-latest"
 docker buildx imagetools create -t "${IMAGE}:base-latest" "${IMAGE}:${BASE_TAG}"
 
-# -------- 3-5. variants --------
+# -------- 3-4. variants --------
 build_variant() {
-  local suffix="$1"      # "" | "-omos" | "-with-pi" | "-omos-with-pi" | "-pi-only"
+  local suffix="$1"      # "" | "-omos"
   local install_omos="$2"
-  local install_pi="$3"
-  local install_opencode="${4:-true}"
+  local install_opencode="${3:-true}"
   local extra_args=()
-  [[ "$install_pi"   == "true" ]] && extra_args+=(--build-arg "PI_VERSION=${PI_VERSION}")
   [[ "$install_omos" == "true" ]] && extra_args+=(--build-arg "OMOS_VERSION=${OMOS_VERSION}")
 
   local versioned="${IMAGE}:${RELEASE_TAG}${suffix}"
@@ -85,7 +82,6 @@ build_variant() {
     --build-arg "BASE_IMAGE=${IMAGE}:${BASE_TAG}" \
     --build-arg "INSTALL_OPENCODE=${install_opencode}" \
     --build-arg "INSTALL_OMOS=${install_omos}" \
-    --build-arg "INSTALL_PI=${install_pi}" \
     ${extra_args[@]+"${extra_args[@]}"} \
     -t "${versioned}" \
     -t "${floating}" \
@@ -93,29 +89,17 @@ build_variant() {
     .
 }
 
-echo "==> [3/7] Variant: base (opencode only)"
-build_variant ""               false false
+echo "==> [3/4] Variant: base (opencode only)"
+build_variant ""               false
 
-echo "==> [4/7] Variant: omos"
-build_variant "-omos"          true  false
-
-echo "==> [5/7] Variant: with-pi"
-build_variant "-with-pi"       false true
-
-echo "==> [6/7] Variant: omos-with-pi"
-build_variant "-omos-with-pi"  true  true
-
-echo "==> [7/7] Variant: pi-only (pi without opencode)"
-build_variant "-pi-only"       false true  false
+echo "==> [4/4] Variant: omos"
+build_variant "-omos"          true
 
 echo
 echo "==> Done. Verifying tags on Hub:"
 for t in \
   "${RELEASE_TAG}" "latest" \
   "${RELEASE_TAG}-omos" "latest-omos" \
-  "${RELEASE_TAG}-with-pi" "latest-with-pi" \
-  "${RELEASE_TAG}-omos-with-pi" "latest-omos-with-pi" \
-  "${RELEASE_TAG}-pi-only" "latest-pi-only" \
   "${BASE_TAG}" "base-latest"
 do
   d=$(docker manifest inspect "${IMAGE}:${t}" 2>/dev/null | python3 -c "import json,sys,hashlib; m=json.load(sys.stdin); print(m.get('digest','-'))" 2>/dev/null || echo "MISSING")