docs(readme): backfill user docs for v2.4.0-v2.7.0 features

Features that shipped without README prose are now documented:
- PDF export (pandoc --pdf-engine=typst) — new Document conversion section
- Terminal TERM/terminfo support (ncurses-term, kitty-terminfo, xterm-ghostty)
- Neovim 24-bit colour default (termguicolors via system sysinit.vim)
- first-shell host SSH reachability check (Shell defaults list)
- baked global gitignore (patterns + core.excludesFile wiring)
- Build Args table: add MICRO_VERSION, TEALDEER_VERSION, TYPST_VERSION

Docs-only; noted under CHANGELOG Unreleased. Hub template and .env.example
were already accurate. Drift found via a v2.4.0+ CHANGELOG-vs-docs audit.

CHANGELOG.md

@@ -28,6 +28,10 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
   `OPENCODE_EXPERIMENTAL_BACKGROUND_SUBAGENTS` removal-trigger was re-checked
   against these release notes and has **not** fired; the flag stays baked ON.
 
+### Documentation
+
+- **README backfill for v2.4.0–v2.7.0 features that shipped without user-facing docs:** PDF export via `pandoc --pdf-engine=typst` (new *Document conversion* section), terminal `TERM`/terminfo support (`ncurses-term` + `kitty-terminfo` + `xterm-ghostty`), Neovim 24-bit colour default (`termguicolors` via system `sysinit.vim`), the first-shell host SSH reachability check, and the baked global gitignore. Also adds the three floated build args missing from the Build Args table (`MICRO_VERSION`, `TEALDEER_VERSION`, `TYPST_VERSION`). Docs-only — no image change.
+
 ## v2.7.0 — 2026-07-13
 
 Minor release. Headline: **further parity with the sibling `pi-devbox` image** —

README.md

@@ -264,11 +264,23 @@ volumes:
   - ~/.config/nvim:/home/developer/.config/nvim:ro
 ```
 
+24-bit colour is on by default — a system-wide `sysinit.vim` (in `/etc/xdg/nvim/`) enables `termguicolors` so strings and comments render in full colour over SSH instead of a muddy 256-colour palette. It loads before any personal config and stays overridable per-user (`:set notermguicolors`, or your own `~/.config/nvim/init`).
+
 > **Not a vi person?** The image also ships two non-modal editors alongside nvim:
 > **nano** (classic, minimal) and **micro** (modern — desktop-style `Ctrl+S`/`Ctrl+Q`
 > keys, mouse, syntax highlighting). `EDITOR` stays `nvim`; opt in per-shell with
 > `export EDITOR=nano` (or `micro`), or for git with `git config --global core.editor micro`.
 
+### Document conversion (Markdown → PDF)
+
+The image ships [`pandoc`](https://pandoc.org/) with [`typst`](https://typst.app/) as the PDF engine, so Markdown → PDF works out of the box with no LaTeX install:
+
+```bash
+pandoc README.md -o readme.pdf --pdf-engine=typst
+```
+
+The bundled pandoc typst template defaults the font to `Libertinus Serif`, so a bare `--pdf-engine=typst` renders without needing `-V mainfont`. For higher-fidelity or complex layouts, install TeX Live on demand and use `--pdf-engine=xelatex` instead.
+
 ### Python development with uv
 
 The image includes Python 3.13 (from Debian Trixie) and [uv](https://docs.astral.sh/uv/), a fast Python package manager that replaces pip, venv, and pyenv:
@@ -453,7 +465,7 @@ docker compose build --build-arg NVIM_VERSION=0.12.1   # pin to a specific versi
 | `INSTALL_OPENCODE` | `true` | Install opencode. Set `false` to build a base with no harness (still includes Bun if `INSTALL_OMOS=true`). |
 | `OPENCODE_VERSION` | *(pinned per release)* | opencode npm version. Drives the image tag and is intentionally not floated. |
 | `NODE_VERSION` | `22` | Node.js major version. Pinned to protect against upstream breaking changes across majors. |
-| `GOSU_VERSION`, `FZF_VERSION`, `GIT_LFS_VERSION`, `NVIM_VERSION`, `BAT_VERSION`, `EZA_VERSION`, `ZOXIDE_VERSION`, `UV_VERSION`, `GITEA_MCP_VERSION`, `GO_VERSION`, `OMOS_VERSION` | `latest` | All GitHub/Gitea/go.dev-hosted binaries resolve to the newest upstream release at build time. Override with a specific version to pin. Resolved versions are logged in CI output. |
+| `GOSU_VERSION`, `FZF_VERSION`, `GIT_LFS_VERSION`, `NVIM_VERSION`, `BAT_VERSION`, `EZA_VERSION`, `ZOXIDE_VERSION`, `UV_VERSION`, `GITEA_MCP_VERSION`, `GO_VERSION`, `OMOS_VERSION`, `MICRO_VERSION`, `TEALDEER_VERSION`, `TYPST_VERSION` | `latest` | All GitHub/Gitea/go.dev-hosted binaries resolve to the newest upstream release at build time. Override with a specific version to pin. Resolved versions are logged in CI output. |
 
 > **Reproducibility note:** With `latest` defaults, two builds of the same `v{opencode}` tag may embed different tool versions if upstream releases have happened in between. This is intentional — it means every rebuild picks up upstream CVE fixes automatically. If you need a bit-for-bit reproducible build, pass explicit `*_VERSION` args. The CI smoke test logs the resolved versions for every release build.
 
@@ -761,6 +773,7 @@ Defaults you get out of the box:
 - **Aliases** — `ls`/`ll`/`la` use `eza`, `cat` uses `bat`, `gs`/`gd`/`gl` for git, safe `rm`/`mv`/`cp`.
 - **Integrations** — `zoxide` (`z <fragment>` to jump), `fzf` Ctrl-R / Ctrl-T key bindings.
 - **Prompt marker** — `[devbox]` prefix so it's always obvious you're inside the container.
+- **Host SSH reachability check** — on the first shell of a freshly (re)created container, a one-time probe checks whether the Docker host is reachable over SSH. If it isn't (host Remote Login off, or the container's `devbox_jump` key not yet authorized), it prints a clear two-step fix with the container's public key inline; it stays silent once SSH works and is skipped on later shells.
 
 ### Overriding the defaults
 
@@ -794,6 +807,14 @@ cp /etc/skel-devbox/.bash_aliases ~/.bash_aliases
 rm ~/.bash_aliases
 ```
 
+## Terminal compatibility
+
+The base ships `ncurses-term` and `kitty-terminfo` on top of the default `ncurses-base`, plus a compiled `xterm-ghostty` alias, so modern terminal emulators resolve their `TERM` correctly over SSH instead of degrading to a dumb fallback. Covered out of the box: WezTerm, Alacritty, foot, st, kitty (`xterm-kitty`), Ghostty (`xterm-ghostty`), and iTerm2 / xterm (`xterm-256color`).
+
+## Global gitignore
+
+The image bakes a `~/.gitignore_global` and wires it via `git config --global core.excludesFile`, so personal/tooling artifacts are ignored across every repo in the container without per-repo `.gitignore` entries. Seeded patterns include `*.bak`, `*.bak.*`, `*~`, `*.orig`, `*.swp`, `*.tmp`, and `**/.claude/settings.local.json` (Claude Code's per-machine settings, which can carry credentials). It is seeded only if absent — edit it freely, and your version survives recreate — and the `core.excludesFile` wiring is skipped if you already set one.
+
 ## Secret Scanning
 
 A [gitleaks](https://github.com/gitleaks/gitleaks) pre-commit hook prevents accidentally committing API keys, passwords, or other secrets.
@@ -837,7 +858,7 @@ Container (Debian trixie)
 ├── AWS CLI v2 (SSO + Bedrock auth)
 ├── neovim 0.12, nano, micro, tmux, htop, bat, eza, zoxide, uv, rustup, make, gcc, g++, rsync
 ├── git, git-crypt, age, gitleaks, ssh, ripgrep, fd, fzf, jq, yq, curl, tree
-├── pandoc (Markdown↔HTML/PDF/etc. conversion)
+├── pandoc + typst (Markdown→PDF via --pdf-engine=typst; HTML/etc.)
 ├── graphviz (dot diagram rendering)
 ├── tldr (tealdeer — quick command examples)
 ├── dot-watch (auto-render .dot to PNG on save)