feat(entrypoint): link ~/.pi/agent/models.json to a mounted shared file

pi reads custom providers from ~/.pi/agent/models.json, and ~/.pi is the
devbox-pi-config named volume. A file baked into the image would only seed a
fresh volume, once. A hand-made link is one more step on every new volume: on
2026-10-12 that was the same `ln -s /opt/fleet-pi/models.json …` once per
device, for one fleet-shared file.

New rootfs/usr/local/lib/pi-devbox/link-pi-models.sh, called from
entrypoint-user.sh after the pi-toolkit and pi-extensions installs. When
/opt/fleet-pi/models.json exists (PI_MODELS_JSON overrides the path, =off
disables it), it links ~/.pi/agent/models.json to it, honouring
PI_CODING_AGENT_DIR. It only ever creates a link where nothing exists: a real
file or a link of the user's own is left alone, with one NOTE line. With
nothing mounted, it does nothing and prints nothing. A link whose target later
vanishes is harmless; measured with pi 1.0.0, a dangling models.json behaves
like a missing one (rc 0, no error, no custom models).

Tests:
- scripts/test-link-pi-models.sh: 13 two-sided cases against a throwaway HOME.
  Wired into lint.yml, so it runs on every push and not only at release.
- Of 11 mutations, 10 are caught. The 11th (ln -s -> ln -sfn on the final
  link) is unreachable behind the guards.
- smoke-test.sh: with nothing mounted no link appears, and the script links a
  mounted file. Both commands were run under dash here.
- recreate-sanity-check.sh: pass, warn or fail on the link, but only when a
  shared file is mounted. Here it passes.

Docs:
- README "Custom model providers (models.json)": mount the DIRECTORY (git pull
  renames, and a single-file mount then shows "No such file" until recreate),
  keep keys in .env as "$NAME".
- .env.example: PI_MODELS_JSON.

Local gates green: lint-shell, check-workflow-shell, check-dockerfile-directives,
check-base-hash, check-doc-drift.

CHANGELOG.md

@@ -22,6 +22,35 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ### Added
 
+- **Shared custom model providers: `~/.pi/agent/models.json` is linked to a
+  mounted file at every start.** Mount a host *directory* read-only at
+  `/opt/fleet-pi`, and new `rootfs/usr/local/lib/pi-devbox/link-pi-models.sh`
+  links `~/.pi/agent/models.json` to `/opt/fleet-pi/models.json`. It runs from
+  `entrypoint-user.sh`. `PI_MODELS_JSON` points at another path, and `=off`
+  disables it. It only ever creates a link where nothing exists: a real file or a
+  link of your own is left alone, with one `NOTE` line in `docker logs`.
+
+  Why this is needed: pi reads custom providers (company gateways, vLLM, Ollama,
+  …) from `~/.pi/agent/models.json`, and `~/.pi` is the `devbox-pi-config`
+  volume. A file baked into the image would only seed a fresh volume once, and a
+  hand-made link was one more step on every new volume. In October 2026 that was
+  the same `ln -s` once per device for one fleet-shared file. Mount the
+  directory, not the file. `git pull` replaces the file by rename, and a
+  single-file bind mount then shows "No such file" until the next recreate
+  (measured on Docker Desktop).
+
+  Tests:
+  - `scripts/test-link-pi-models.sh` has 13 two-sided cases and now runs in
+    `lint.yml` on every push. Every mutation of a rule was caught, except one
+    that the guards make unreachable.
+  - Two smoke-test checks: with nothing mounted no link appears, and the script
+    links a mounted file.
+  - `recreate-sanity-check.sh` checks the link whenever a shared file is mounted.
+
+  pi treats a dangling `models.json` exactly like a missing one, with no error,
+  so removing the mount later is harmless (measured with pi 1.0.0). README:
+  "Custom model providers (`models.json`)".
+
 - **Long Bedrock runs no longer die at "Token is expired" when the AWS SSO
   session ends: `/aws-sso` (pi-extensions `aws-sso.ts`) runs `aws sso login` for
   you just after the session ends.** Off until `/aws-sso on` (or