v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

docs/manual-host-publish.sh

@@ -1,35 +1,34 @@
 #!/usr/bin/env bash
-# Manual publish of opencode-devbox v1.15.12 — bypasses broken Gitea-runner
-# Hub push by building & pushing from a developer host (Orbstack/Docker Desktop).
+# Manual publish of opencode-devbox — bypasses a broken Gitea-runner Hub push
+# by building & pushing from a developer host (Orbstack/Docker Desktop).
 #
 # Mirrors what .gitea/workflows/docker-publish-split.yml would do:
 #   1. Build & push Dockerfile.base    → joakimp/opencode-devbox:base-<hash>
 #   2. Promote                         → joakimp/opencode-devbox:base-latest
-#   3. Build & push 5 variants on top of base-<hash>:
-#        :v1.15.12              :latest              (INSTALL_OPENCODE only)
-#        :v1.15.12-omos         :latest-omos         (+ OMOS)
-#        :v1.15.12-with-pi      :latest-with-pi      (+ pi)
-#        :v1.15.12-omos-with-pi :latest-omos-with-pi (+ both)
-#        :v1.15.12-pi-only      :latest-pi-only      (pi, no opencode)
+#   3. Build & push 2 variants on top of base-<hash>:
+#        :vX.Y.Z              :latest              (INSTALL_OPENCODE only)
+#        :vX.Y.Z-omos         :latest-omos         (+ OMOS)
+#
+# pi was removed in v2.0.0 — there are no pi variants here anymore.
 #
 # Usage on your host:
 #   1. Make sure Orbstack/Docker Desktop is running with multi-arch enabled
 #      (docker buildx ls should show linux/amd64,linux/arm64).
 #   2. docker login docker.io   (joakimp account)
-#   3. cd ~/path/to/opencode-devbox && git fetch && git checkout v1.15.12
-#   4. bash /path/to/this/script.sh
+#   3. cd ~/path/to/opencode-devbox && git fetch && git checkout <RELEASE_TAG>
+#   4. Edit RELEASE_TAG / BASE_HASH / OMOS_VERSION below to match the release.
+#   5. bash /path/to/this/script.sh
 #
-# Total expected time: ~25-40 min on a recent Mac (4 multi-arch builds, base
+# Total expected time: ~15-25 min on a recent Mac (2 multi-arch builds, base
 # layers cache after the first variant).
 
 set -euo pipefail
 
 IMAGE="joakimp/opencode-devbox"
-RELEASE_TAG="v1.15.12"
-BASE_HASH="8d72a9e44796"        # sha256 of Dockerfile.base + rootfs/* + entrypoints (computed by CI logic)
+RELEASE_TAG="v2.0.0"            # EDIT per release
+BASE_HASH="REPLACE_ME"          # sha256 of Dockerfile.base + rootfs/* + entrypoints (computed by CI logic)
 BASE_TAG="base-${BASE_HASH}"
-PI_VERSION="0.76.0"             # resolved from npm @earendil-works/pi-coding-agent latest (2026-05-28)
-OMOS_VERSION="1.1.1"            # resolved from npm oh-my-opencode-slim latest (2026-05-28)
+OMOS_VERSION="latest"           # resolve from npm oh-my-opencode-slim latest, then pin
 PLATFORMS="linux/amd64,linux/arm64"
 
 # -------- preflight --------
@@ -65,14 +64,12 @@ fi
 echo "==> [2/7] Promote ${IMAGE}:${BASE_TAG} → ${IMAGE}:base-latest"
 docker buildx imagetools create -t "${IMAGE}:base-latest" "${IMAGE}:${BASE_TAG}"
 
-# -------- 3-5. variants --------
+# -------- 3-4. variants --------
 build_variant() {
-  local suffix="$1"      # "" | "-omos" | "-with-pi" | "-omos-with-pi" | "-pi-only"
+  local suffix="$1"      # "" | "-omos"
   local install_omos="$2"
-  local install_pi="$3"
-  local install_opencode="${4:-true}"
+  local install_opencode="${3:-true}"
   local extra_args=()
-  [[ "$install_pi"   == "true" ]] && extra_args+=(--build-arg "PI_VERSION=${PI_VERSION}")
   [[ "$install_omos" == "true" ]] && extra_args+=(--build-arg "OMOS_VERSION=${OMOS_VERSION}")
 
   local versioned="${IMAGE}:${RELEASE_TAG}${suffix}"
@@ -85,7 +82,6 @@ build_variant() {
     --build-arg "BASE_IMAGE=${IMAGE}:${BASE_TAG}" \
     --build-arg "INSTALL_OPENCODE=${install_opencode}" \
     --build-arg "INSTALL_OMOS=${install_omos}" \
-    --build-arg "INSTALL_PI=${install_pi}" \
     ${extra_args[@]+"${extra_args[@]}"} \
     -t "${versioned}" \
     -t "${floating}" \
@@ -93,29 +89,17 @@ build_variant() {
     .
 }
 
-echo "==> [3/7] Variant: base (opencode only)"
-build_variant ""               false false
+echo "==> [3/4] Variant: base (opencode only)"
+build_variant ""               false
 
-echo "==> [4/7] Variant: omos"
-build_variant "-omos"          true  false
-
-echo "==> [5/7] Variant: with-pi"
-build_variant "-with-pi"       false true
-
-echo "==> [6/7] Variant: omos-with-pi"
-build_variant "-omos-with-pi"  true  true
-
-echo "==> [7/7] Variant: pi-only (pi without opencode)"
-build_variant "-pi-only"       false true  false
+echo "==> [4/4] Variant: omos"
+build_variant "-omos"          true
 
 echo
 echo "==> Done. Verifying tags on Hub:"
 for t in \
   "${RELEASE_TAG}" "latest" \
   "${RELEASE_TAG}-omos" "latest-omos" \
-  "${RELEASE_TAG}-with-pi" "latest-with-pi" \
-  "${RELEASE_TAG}-omos-with-pi" "latest-omos-with-pi" \
-  "${RELEASE_TAG}-pi-only" "latest-pi-only" \
   "${BASE_TAG}" "base-latest"
 do
   d=$(docker manifest inspect "${IMAGE}:${t}" 2>/dev/null | python3 -c "import json,sys,hashlib; m=json.load(sys.stdin); print(m.get('digest','-'))" 2>/dev/null || echo "MISSING")