refactor: build FROM joakimp/pi-devbox:base-pi-only (Option B)

The pi-only building block now lives in this repo as the internal
base-pi-only tag (produced by opencode-devbox CI from Dockerfile.variant,
INSTALL_OPENCODE=false) instead of opencode-devbox:latest-pi-only — so an
'opencode-devbox' tag never ships without opencode.

- Dockerfile: BASE_IMAGE default joakimp/opencode-devbox:latest-pi-only
  -> joakimp/pi-devbox:base-pi-only.
- Updated README, AGENTS, DOCKER_HUB, docker-compose, CHANGELOG.
- Single source of truth unchanged (opencode-devbox/Dockerfile.variant);
  publish ordering + EXPECTED_PI_VERSION smoke guard unchanged.

CHANGELOG.md

@@ -11,12 +11,21 @@ Tags follow the pi npm version: `v{pi_version}[letter]` — bare tag for the fir
 ### Changed: refactored to re-brand the opencode-devbox `pi-only` variant
 
 pi-devbox no longer installs pi itself. The `Dockerfile` is now a thin
-`FROM joakimp/opencode-devbox:latest-pi-only` (overridable via the `BASE_IMAGE`
+`FROM joakimp/pi-devbox:base-pi-only` (overridable via the `BASE_IMAGE`
 arg), inheriting pi + pi-toolkit + pi-extensions and all base tooling from the
 single source of truth. This eliminates the install-logic duplication that
 used to drift against `opencode-devbox/Dockerfile.variant`.
 
-The `pi-only` variant is built with `INSTALL_OPENCODE=false`, so this image
+The pi-only artifact is **built** by opencode-devbox's CI (from
+`opencode-devbox/Dockerfile.variant` with `INSTALL_OPENCODE=false`) but is
+**published into this repo** as the internal building-block tag
+`joakimp/pi-devbox:base-pi-only` (+ `base-pi-only-vX.Y.Z`, where `vX.Y.Z` is
+the opencode-devbox release version). This supersedes the brief approach of
+publishing it as `opencode-devbox:latest-pi-only` — an "opencode-devbox" tag
+with no opencode in it confused users. `base-pi-only` is internal; end users
+pull `joakimp/pi-devbox:latest` or a `vX.Y.Z` tag.
+
+The pi-only build uses `INSTALL_OPENCODE=false`, so this image
 stays lean and pi-focused — it does **not** carry opencode, and remains
 distinct from `opencode-devbox:latest-with-pi` (which has both).
 
@@ -31,7 +40,7 @@ distinct from `opencode-devbox:latest-with-pi` (which has both).
 
 ### Consequences / notes
 
-- **Publish ordering**: release opencode-devbox first so `latest-pi-only`
+- **Publish ordering**: release opencode-devbox first so `base-pi-only`
   carries the target pi version, *then* tag this repo. The smoke test asserts
   `pi --version` matches the tag and fails loudly if the base is stale.
 - CI no longer passes `PI_VERSION` as a build-arg (the Dockerfile installs