v1.17.2: bump opencode 1.16.2->1.17.2, deprecate pi, pin+patch mempalace

opencode-ai 1.16.2 -> 1.17.2 (OPENCODE_VERSION).

Deprecate all pi support ahead of v2.0.0 removal (pi now ships from the
standalone joakimp/pi-devbox image, v1.0.0+, which no longer FROMs
base-pi-only):
- build-time stderr deprecation warning when INSTALL_PI=true
- README / DOCKER_HUB.md / AGENTS.md mark the with-pi/omos-with-pi/pi-only
  variants + base-pi-only tag deprecated, point to pi-devbox
- docs/CLEANUP-v2.0.0.md committed as the removal plan
- CHANGELOG pre-announces the v2.0.0 NPM_CONFIG_PREFIX relocation

Harden mempalace install (mirrors pi-devbox):
- pin via MEMPALACE_VERSION ARG (default 3.4.0); unpinned install is what
  swept in the broken schema
- idempotent, self-deactivating patch stripping the top-level anyOf from
  mempalace_diary_write input_schema (Anthropic tools API rejects it).
  Upstream: MemPalace/mempalace#1728, PR #1735

Fold prior Unreleased smoke-test pi-extensions readiness fix into v1.17.2.

Dockerfile.variant

@@ -10,14 +10,19 @@
 #   ─────────────────  ────────────────  ────────────  ──────────
 #   base               true              false         false
 #   omos               true              true          false
-#   with-pi            true              false         true
-#   omos-with-pi       true              true          true
-#   pi-only            false             false         true
+#   with-pi *DEPR*     true              false         true
+#   omos-with-pi*DEPR* true              true          true
+#   pi-only *DEPR*     false             false         true
 #
-# The `pi-only` variant is the single source of truth for the pi-devbox
-# image (pi + companions, no opencode). It exists so pi-devbox can FROM it
-# without inheriting opencode, while the pi install logic stays defined
-# here in one place.
+# DEPRECATION (since v1.17.2): the three pi-bearing variants (with-pi,
+# omos-with-pi, pi-only) and the INSTALL_PI build path are DEPRECATED and
+# will be REMOVED in v2.0.0. pi now ships from its own self-contained image:
+# joakimp/pi-devbox:latest (https://gitea.jordbo.se/joakimp/pi-devbox).
+# See docs/CLEANUP-v2.0.0.md for the removal plan.
+#
+# Until v2.0.0 the `pi-only` variant remains the source of truth for the
+# legacy pi build (pi + companions, no opencode); pi-devbox v1.0.0+ no
+# longer FROMs it.
 #
 # Pass `--build-arg BASE_IMAGE=<repo>:base-<hash>` to select the base.
 # The CI workflow computes the base hash from Dockerfile.base + rootfs/
@@ -42,7 +47,7 @@ ARG USER_NAME=developer
 # edit, so the cache-hit class of bug that bit pi-devbox v0.74.0..
 # v0.75.5 cannot apply here.
 ARG INSTALL_OPENCODE=true
-ARG OPENCODE_VERSION=1.16.2
+ARG OPENCODE_VERSION=1.17.2
 RUN if [ "${INSTALL_OPENCODE}" = "true" ]; then \
       NPM_CONFIG_PREFIX=/usr npm install -g opencode-ai@${OPENCODE_VERSION} && \
       opencode --version ; \
@@ -81,6 +86,13 @@ ARG PI_OBSMEM_REPO=https://github.com/elpapi42/pi-observational-memory.git
 ARG PI_OBSMEM_REF=master
 RUN if [ "${INSTALL_PI}" = "true" ]; then \
       set -e && \
+      printf '%s\n' \
+        "===========================================================" \
+        "DEPRECATION WARNING: INSTALL_PI is deprecated in opencode-devbox" \
+        "(since v1.17.2) and will be REMOVED in v2.0.0. Use the dedicated" \
+        "image joakimp/pi-devbox:latest instead." \
+        "See https://gitea.jordbo.se/joakimp/pi-devbox" \
+        "===========================================================" >&2 && \
       git_clone_retry() { \
         url="$1"; ref="$2"; dest="$3"; \
         for i in 1 2 3 4 5; do \