release: v2.4.0 — nano + micro editors, CI hardening, opencode 1.17.10 → 1.17.13

Promotes the Unreleased block to v2.4.0. Bundled contents:
- feat: nano + micro non-modal editors (d9ad634) — Dockerfile.base change → base rebuild
- ci: sh-vs-bash guard + base-latest digest promote, ported from pi-devbox (acb2096)
- feat: global gitignore baked into the image (6639ba5)
- opencode 1.17.10 → 1.17.13 (Dockerfile.variant)

Also registers .gitea/workflows/lint.yml in AGENTS.md's workflow list.
DOCKER_HUB.md unchanged (HUB_TEMPLATE untouched; --check passes).
Pre-flight: opencode-ai@1.17.13 confirmed on npm (== latest).

AGENTS.md

@@ -29,6 +29,7 @@ Docker image packaging [opencode](https://opencode.ai) into a production-ready d
 - `.gitea/README.md` — **read this first** if you're touching CI. Architectural overview of the build pipeline (production vs split-base), wall-clock estimates, NPM_CONFIG_PREFIX gotcha, runner expectations, migration plan.
 - `.gitea/workflows/validate.yml` — lightweight amd64 build + smoke test on push to main and PRs. Also runs the DOCKER_HUB.md sync check.
 - `.gitea/workflows/docker-publish-split.yml` — production CI pipeline on tag push (`v*`). Two-phase split-base: computes base hash, conditionally builds base, runs 2 parallel smoke tests, then 2 parallel multi-arch variant builds, promotes `base-latest` alias, updates Docker Hub description.
+- `.gitea/workflows/lint.yml` — cheap (~10s) workflow-lint on every push/PR/dispatch: a Gitea-accurate shell guard (`scripts/check-workflow-shell.sh`) plus pinned actionlint + shellcheck. The guard asserts every `run:` step resolves to `bash` under Gitea's `sh` default, closing the actionlint blind spot (actionlint models GitHub, whose default `run` shell is bash). Ported from pi-devbox.
 
 ## Versioning scheme
 

CHANGELOG.md

@@ -6,7 +6,22 @@ Tags follow **independent semver** (since `v2.0.0`) — they version *this image
 
 ---
 
-## Unreleased
+## v2.4.0 — 2026-07-01
+
+Minor release. Adds two **non-modal editors** (`nano` + `micro`) alongside
+nvim, ports **CI hardening** from pi-devbox (the sh-vs-bash workflow guard and
+the `base-latest` digest-based promote fix), bakes a **global gitignore** into
+the image, and bumps **opencode `1.17.10` → `1.17.13`**. Because
+`Dockerfile.base` changed (nano + micro), this release rebuilds the base image.
+
+### Changed
+
+- **opencode `1.17.10` → `1.17.13`** (three upstream patches). Highlights:
+  session snapshots + revert controls (1.17.11); MCP OAuth reconnect/refresh
+  fixes, a TUI yolo auto-approve mode, and better default small models
+  (1.17.12); forced reasoning mode for OpenAI-compatible reasoning models plus
+  a GitHub Copilot stale-response-ID fix (1.17.13). Full notes:
+  <https://github.com/anomalyco/opencode/releases>.
 
 ### Added
 

Dockerfile.variant

@@ -39,7 +39,7 @@ ARG USER_NAME=developer
 # edit, so the cache-hit class of bug that bit pi-devbox v0.74.0..
 # v0.75.5 cannot apply here.
 ARG INSTALL_OPENCODE=true
-ARG OPENCODE_VERSION=1.17.10
+ARG OPENCODE_VERSION=1.17.13
 RUN if [ "${INSTALL_OPENCODE}" = "true" ]; then \
       NPM_CONFIG_PREFIX=/usr npm install -g opencode-ai@${OPENCODE_VERSION} && \
       opencode --version ; \