v1.17.2: bump opencode 1.16.2->1.17.2, deprecate pi, pin+patch mempalace

opencode-ai 1.16.2 -> 1.17.2 (OPENCODE_VERSION).

Deprecate all pi support ahead of v2.0.0 removal (pi now ships from the
standalone joakimp/pi-devbox image, v1.0.0+, which no longer FROMs
base-pi-only):
- build-time stderr deprecation warning when INSTALL_PI=true
- README / DOCKER_HUB.md / AGENTS.md mark the with-pi/omos-with-pi/pi-only
  variants + base-pi-only tag deprecated, point to pi-devbox
- docs/CLEANUP-v2.0.0.md committed as the removal plan
- CHANGELOG pre-announces the v2.0.0 NPM_CONFIG_PREFIX relocation

Harden mempalace install (mirrors pi-devbox):
- pin via MEMPALACE_VERSION ARG (default 3.4.0); unpinned install is what
  swept in the broken schema
- idempotent, self-deactivating patch stripping the top-level anyOf from
  mempalace_diary_write input_schema (Anthropic tools API rejects it).
  Upstream: MemPalace/mempalace#1728, PR #1735

Fold prior Unreleased smoke-test pi-extensions readiness fix into v1.17.2.

CHANGELOG.md

@@ -8,6 +8,77 @@ Tags follow `v{opencode_version}[letter]` — bare tag for the first build on a
 
 ## Unreleased
 
+## v1.17.2 — 2026-06-10
+
+First container build on **opencode-ai `1.17.2`** (from `1.16.2`). This
+release also **deprecates all pi support** ahead of its removal in v2.0.0,
+and hardens the mempalace install.
+
+### Bumped: opencode-ai 1.16.2 → 1.17.2
+
+`OPENCODE_VERSION` ARG in `Dockerfile.variant`. Bare `v1.17.2` tag per the
+`v{opencode_version}` scheme.
+
+### Deprecated: pi support (removed in v2.0.0)
+
+pi has been decoupled into its own self-contained image,
+[`joakimp/pi-devbox`](https://gitea.jordbo.se/joakimp/pi-devbox) (v1.0.0+,
+which no longer FROMs `base-pi-only`). The pi paths in opencode-devbox are
+now dead weight and are **deprecated as of v1.17.2, scheduled for removal in
+v2.0.0**:
+
+- The `INSTALL_PI` build arg and all `PI_*` args.
+- The `with-pi`, `omos-with-pi`, and `pi-only` build variants.
+- The `base-pi-only[-vX.Y.Z]` tag published (to the `joakimp/pi-devbox`
+  repo) from this repo's CI.
+- All `~/.pi`-related entrypoint wiring (pi-toolkit / pi-extensions deploy,
+  settings.json bootstrap, mempalace pi-bridge symlink, pi-fork / pi-obsmem
+  registration).
+
+What this release does:
+
+- Building with `INSTALL_PI=true` now prints a **build-time deprecation
+  warning** to stderr.
+- README, DOCKER_HUB.md, and AGENTS.md mark the pi variants deprecated and
+  point to `joakimp/pi-devbox`.
+- The full removal plan is documented in `docs/CLEANUP-v2.0.0.md`.
+
+**Migration:** pull `joakimp/pi-devbox:latest` directly instead of any
+`*-with-pi` / `pi-only` opencode-devbox tag. opencode-only users are
+unaffected by this release.
+
+#### ⚠ Heads-up for v2.0.0: global npm prefix relocation
+
+Today `NPM_CONFIG_PREFIX` points at the pi-specific `~/.pi/npm-global`
+(backed by the `devbox-pi-config` named volume), so `npm install -g` as the
+developer user persists across recreates. **v2.0.0 will move the prefix to a
+neutral opencode path** (e.g. `~/.config/opencode/npm-global`). Consequences
+for existing opencode users at the v2.0.0 upgrade:
+
+- Previously global-installed npm tools remain on disk in the old volume but
+  **drop off `PATH`** until migrated.
+- The new prefix path is not currently a named volume, so persistence needs a
+  compose/volume update.
+
+v2.0.0 will ship a **one-time migration shim** (copies old prefix contents to
+the new path on first run) and an updated volume mapping. This notice is the
+one-release-cycle advance warning.
+
+### Hardened: mempalace install pinned + diary_write schema workaround
+
+- `MEMPALACE_VERSION` is now an explicit ARG (default `3.4.0`) in
+  `Dockerfile.base`; the install uses `mempalace==${MEMPALACE_VERSION}`
+  instead of an unpinned `uv tool install mempalace`. An unpinned install is
+  what silently swept in the broken `diary_write` schema. Mirrors pi-devbox.
+- Added an idempotent, self-deactivating post-install patch that strips the
+  **top-level `anyOf`** from `mempalace_diary_write`'s `input_schema`.
+  Mempalace 3.3.x/3.4.0 advertise `anyOf:[{required:[entry]},{required:[content]}]`
+  at the schema root, which the Anthropic tools API rejects outright
+  (`input_schema does not support oneOf, allOf, or anyOf at the top level`),
+  breaking pi/Claude tool registration at session start. The handler still
+  accepts `content` server-side. Upstream: MemPalace/mempalace#1728, PR #1735.
+  Remove once a fixed mempalace release is pinned.
+
 ### Fixed: smoke-test pi-extensions readiness race (test-only, no image change)
 
 `scripts/smoke-test.sh`'s entrypoint-deploy wait loop gated only on
@@ -17,10 +88,7 @@ see fewer than 4 files under parallel build load. Observed on v1.16.2 run 370:
 `smoke-with-pi` saw `<4` while `smoke-omos-with-pi` / `smoke-pi-only` (identical
 pi-extensions `357fcc6`) both saw 8, skipping `build-variant-with-pi`. The wait
 loop now blocks until the *last*-deployed artifact (the `mempalace.ts` bridge
-symlink) exists **and** the extension count has settled ≥ 4 (up to 45s). Affects
-only when smoke samples the container — image bytes are unchanged, so this does
-not warrant a new tag; it lands in the next release and is exercised by
-`validate.yml` on this push.
+symlink) exists **and** the extension count has settled ≥ 4 (up to 45s).
 
 ## v1.16.2 — 2026-06-08