refactor: build FROM joakimp/pi-devbox:base-pi-only (Option B)

The pi-only building block now lives in this repo as the internal
base-pi-only tag (produced by opencode-devbox CI from Dockerfile.variant,
INSTALL_OPENCODE=false) instead of opencode-devbox:latest-pi-only — so an
'opencode-devbox' tag never ships without opencode.

- Dockerfile: BASE_IMAGE default joakimp/opencode-devbox:latest-pi-only
  -> joakimp/pi-devbox:base-pi-only.
- Updated README, AGENTS, DOCKER_HUB, docker-compose, CHANGELOG.
- Single source of truth unchanged (opencode-devbox/Dockerfile.variant);
  publish ordering + EXPECTED_PI_VERSION smoke guard unchanged.

Dockerfile

@@ -1,29 +1,34 @@
 # pi-devbox — pi coding-agent container
 #
-# As of 2026-06-03 this image is a thin re-brand of the opencode-devbox
-# "pi-only" variant, which is the SINGLE SOURCE OF TRUTH for the pi install
-# and its companion repos (pi-toolkit, pi-extensions, pi-fork,
-# pi-observational-memory). Previously pi-devbox/Dockerfile duplicated that
-# install logic, which drifted from opencode-devbox/Dockerfile.variant; this
-# refactor eliminates the duplication.
+# As of 2026-06-03 this image is a thin re-brand of the "pi-only" build, which
+# is the SINGLE SOURCE OF TRUTH for the pi install and its companion repos
+# (pi-toolkit, pi-extensions, pi-fork, pi-observational-memory). That build is
+# produced by opencode-devbox's CI (from opencode-devbox/Dockerfile.variant
+# with INSTALL_OPENCODE=false), but is published as an INTERNAL building-block
+# tag in THIS repo — joakimp/pi-devbox:base-pi-only — NOT under opencode-devbox.
+# Rationale: an "opencode-devbox" tag containing no opencode confuses
+# opencode-devbox users, so the pi-only artifact lives here instead.
+# Previously pi-devbox/Dockerfile duplicated the install logic, which drifted
+# from opencode-devbox/Dockerfile.variant; this refactor eliminates the dup.
 #
-# The "pi-only" variant is built with INSTALL_OPENCODE=false, so this image
-# does NOT contain opencode — it stays a lean, pi-focused image, distinct
-# from opencode-devbox:latest-with-pi (which carries both).
+# The pi-only build uses INSTALL_OPENCODE=false, so this image does NOT contain
+# opencode — it stays a lean, pi-focused image, distinct from
+# opencode-devbox:latest-with-pi (which carries both).
 #
-# Everything is inherited from the pi-only image:
+# Everything is inherited from the pi-only build:
 #   pi + pi-toolkit + pi-extensions + pi-fork (fork) + pi-observational-memory
 #   (recall), the mempalace bridge, the LAN-access helper, entrypoints, and
 #   all base dev tooling.
 #
-# NOTE on PUBLISH ORDERING: rebuild opencode-devbox (so `latest-pi-only`
-# carries the target pi version) BEFORE tagging this repo. The smoke test
-# asserts `pi --version` matches this repo's tag and fails loudly if the
-# base is stale — turning the version coupling into an enforced ordering check.
+# NOTE on PUBLISH ORDERING: rebuild opencode-devbox (so `base-pi-only` carries
+# the target pi version) BEFORE tagging this repo. The smoke test asserts
+# `pi --version` matches this repo's tag and fails loudly if the base is stale
+# — turning the version coupling into an enforced ordering check.
 #
-# Override BASE_IMAGE to pin a specific pi-only build (e.g. a version tag or a
-# digest) instead of tracking latest-pi-only.
-ARG BASE_IMAGE=joakimp/opencode-devbox:latest-pi-only
+# base-pi-only is an internal building-block alias (existence-only, not for
+# end users — pull joakimp/pi-devbox:latest or a vX.Y.Z tag instead). Override
+# BASE_IMAGE to pin a specific pi-only build (a version tag or a digest).
+ARG BASE_IMAGE=joakimp/pi-devbox:base-pi-only
 FROM ${BASE_IMAGE}
 
 # WORKDIR / ENTRYPOINT / CMD and all tooling inherited from the base.