v2.0.0: remove pi, relocate npm-global prefix, bump opencode 1.17.2->1.17.4

PR-5 (per docs/CLEANUP-v2.0.0.md). Major release with two breaking changes:

1. pi fully removed (deprecated in v1.17.2). Gone: INSTALL_PI + all PI_*
   build args; with-pi/omos-with-pi/pi-only variants; base-pi-only publish
   job; all ~/.pi entrypoint wiring; the 3 pi smoke/validate/build-variant
   CI jobs. Only base + omos variants remain (4 tags/release).

2. NPM_CONFIG_PREFIX relocated ~/.pi/npm-global -> ~/.config/opencode/npm-global
   (persistent in both compose files). entrypoint-user.sh gains a one-time
   migration shim that copies old global npm packages forward.

Also: opencode 1.17.2->1.17.4; DOCKER_HUB.md gains {{OPENCODE_VERSION}}
placeholder filled by CI at publish time (mirrors pi-devbox); full docs
drift sweep across README/AGENTS/.gitea-README/.env.example/manual-host-publish;
DOCKER_HUB.md regenerated + --check passes; both workflows YAML-valid;
all shell scripts pass bash -n.

entrypoint-user.sh

@@ -36,6 +36,32 @@ if [ -d "$SKEL_DIR" ]; then
   done
 fi
 
+# ── v2.0.0 migration: relocate npm global prefix off the legacy ~/.pi path ──
+# Pre-v2.0.0 images set NPM_CONFIG_PREFIX=~/.pi/npm-global (a pi-specific
+# path). v2.0.0 removed pi and moved the prefix to
+# ~/.config/opencode/npm-global, which is a persistent named volume in every
+# compose layout (the old ~/.pi volume was only in docker-compose.yml). If a
+# user upgraded with the old ~/.pi volume still mounted, copy their
+# previously globally-installed npm packages to the new prefix once so they
+# remain on PATH. The marker keeps this idempotent and a no-op for fresh
+# installs; the whole block is harmless when the old path is absent.
+NEW_NPM_PREFIX="$HOME/.config/opencode/npm-global"
+OLD_NPM_PREFIX="$HOME/.pi/npm-global"
+MIGRATION_MARKER="$NEW_NPM_PREFIX/.migrated-from-dot-pi"
+if [ -d "$OLD_NPM_PREFIX" ] && [ ! -f "$MIGRATION_MARKER" ]; then
+  echo "Migrating npm global prefix: ~/.pi/npm-global -> ~/.config/opencode/npm-global"
+  mkdir -p "$NEW_NPM_PREFIX"
+  # cp -n: never overwrite a file already in the new prefix (a freshly
+  # installed package wins over the legacy copy).
+  for sub in lib bin share; do
+    if [ -d "$OLD_NPM_PREFIX/$sub" ]; then
+      mkdir -p "$NEW_NPM_PREFIX/$sub"
+      cp -an "$OLD_NPM_PREFIX/$sub/." "$NEW_NPM_PREFIX/$sub/" 2>/dev/null || true
+    fi
+  done
+  touch "$MIGRATION_MARKER" 2>/dev/null || true
+fi
+
 # ── MemPalace: initialize palace for the workspace if mempalace is installed
 # Creates the palace directory structure on first run. Idempotent — skips
 # if palace already exists, so upgrades from older versions preserve
@@ -70,62 +96,6 @@ fi
 # generated) and no-ops if OPENCODE_PROVIDER is unset.
 python3 /usr/local/lib/opencode-devbox/generate-config.py
 
-# ── pi: deploy toolkit + extensions + mempalace bridge ─────────────
-# Runs only when pi was baked into the image (INSTALL_PI=true at build).
-# Each install.sh is idempotent and backs up real files before linking,
-# so re-running across container restarts is safe.
-#
-# Order: pi-toolkit first (creates ~/.pi/agent/keybindings.json symlink
-# and writes the AWS env loader), then pi-extensions (symlinks our 6
-# extensions), then settings.json bootstrap from the toolkit template,
-# then the mempalace bridge symlink (one-liner; mempalace-toolkit's
-# install_skill is intentionally skipped to avoid racing with skillset
-# auto-deploy below).
-if command -v pi &>/dev/null; then
-  if [ -d /opt/pi-toolkit ]; then
-    (cd /opt/pi-toolkit && ./install.sh --yes) || \
-      echo "WARN: pi-toolkit install.sh failed (continuing)"
-  fi
-
-  if [ -d /opt/pi-extensions ]; then
-    (cd /opt/pi-extensions && ./install.sh --yes) || \
-      echo "WARN: pi-extensions install.sh failed (continuing)"
-  fi
-
-  # Bootstrap settings.json from template if absent (pi rewrites this
-  # file at runtime — lastChangelogVersion, etc — so we can't symlink it).
-  if [ ! -f "$HOME/.pi/agent/settings.json" ] && \
-     [ -f /opt/pi-toolkit/settings.example.json ]; then
-    cp /opt/pi-toolkit/settings.example.json "$HOME/.pi/agent/settings.json"
-  fi
-
-  # pi↔mempalace MCP bridge — single extension symlink.
-  if [ -f /opt/mempalace-toolkit/extensions/pi/mempalace.ts ] && \
-     command -v mempalace &>/dev/null && \
-     [ ! -L "$HOME/.pi/agent/extensions/mempalace.ts" ]; then
-    ln -sf /opt/mempalace-toolkit/extensions/pi/mempalace.ts \
-           "$HOME/.pi/agent/extensions/mempalace.ts"
-  fi
-
-  # pi-fork (fork tool) + pi-observational-memory (recall tool).
-  # These are pi packages (not symlink-style extensions): they're cloned to
-  # /opt with node_modules baked at BUILD time, then registered here via
-  # `pi install <local-path>`. Verified 2026-06-03: a local-path install is
-  # instant + in-place (pi loads the extension directly from /opt) + idempotent
-  # (no duplicate package entry on re-run), and stores a relative path that
-  # resolves into the image-layer /opt so it survives volume recreate. The
-  # fork/recall tools register on the NEXT pi start (extensions bind at
-  # startup). Guard on settings.json so we only install once per volume.
-  for _pkg in /opt/pi-fork /opt/pi-observational-memory; do
-    [ -d "$_pkg" ] || continue
-    _name=$(basename "$_pkg")
-    if ! grep -q "$_name" "$HOME/.pi/agent/settings.json" 2>/dev/null; then
-      pi install "$_pkg" >/dev/null 2>&1 || \
-        echo "WARN: pi install $_name failed (continuing)"
-    fi
-  done
-fi
-
 # ── Skillset: deploy skills/instructions from mounted skillset repo ──
 # When the skillset repo is mounted (at $HOME/skillset or /workspace/skillset),
 # run the deploy script to create relative symlinks for skills and instructions.