feat(base): add sqlite3, bc, dc and bsdextrautils

sqlite3 is the only one of the four that was genuinely missing rather than
merely absent. MemPalace keeps both the palace and the logstream as SQLite
files (palace/chroma.sqlite3, logstream.sqlite3) and mempalace_status reports a
sqlite_integrity block, so every integrity or forensics check on this fleet has
so far gone through a python3 -c one-liner because the CLI was not in the image.

bc and dc are low value on their own and the CHANGELOG says so plainly: awk,
python3 and perl are all already baked and each is strictly more capable. They
are here because copy-pasted shell snippets assume bc exists. What actually went
wrong on 2026-09-28 was NOT bc's absence: printf '%6.2f' was handed the empty
output of the missing bc and rendered it as a confident "0.00 days" for a figure
that was really 4.81 days. No package fixes that failure mode -- only not taking
a formatted number on trust does.

bsdextrautils ships /usr/bin/column.

Cost MEASURED rather than estimated: 1311 KB total (587 + 236 + 149 + 339) and
ZERO transitive packages. libsqlite3-0, libreadline8t64, zlib1g, libsmartcols1
and libtinfo6 each already report "install ok installed", so nothing new is
pulled under --no-install-recommends.

Package names were verified with apt-cache and dpkg -S on a real trixie host
instead of being inferred, which caught two traps that would each have produced
either a build failure or a silently missing binary: dc is a SEPARATE binary
package from bc on Debian, and column ships in bsdextrautils, not in the
pre-bullseye bsdmainutils where it used to live.

Declined at the same time, recorded so the omission reads as a decision rather
than an oversight: datamash and xsv/csvkit. Python's stdlib csv module handled a
real 7-file Excel-export concatenation that day -- UTF-8 BOM, no trailing
newlines, and bare CR/LF inside quoted fields -- correctly and without them.

Dockerfile.base is in the base hash, so the next tag rebuilds the base (~64 min)
regardless of what else it carries.

CHANGELOG.md

@@ -15,9 +15,10 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 Three small fixes found by the v1.9.4 first-boot acceptance and the CI base
 hash prediction, none release-worthy on its own, plus one boot-time wiring fix
-that stops a recurring `git push` failure inside the container. Nothing here
-changes a pin. `entrypoint-user.sh` is in the base hash, so the next tag
-rebuilds the base (~64 min) regardless of what else it carries.
+that stops a recurring `git push` failure inside the container, and four small
+base packages. Nothing here changes a pin. `entrypoint-user.sh` and
+`Dockerfile.base` are both in the base hash, so the next tag rebuilds the base
+(~64 min) regardless of what else it carries.
 
 ### Components that move with the next build
 
@@ -25,6 +26,31 @@ rebuilds the base (~64 min) regardless of what else it carries.
 |---|---|---|---|
 | pi-extensions | `25c1265` | **`143a214`** | `install.sh`: skip hook activation on a clone this user cannot configure (below) |
 
+### Added
+
+- **Four base packages: `sqlite3`, `bc`, `dc`, `bsdextrautils`** — requested
+  2026-09-28 after a session had to reach for `bc` and found it absent. 1311 KB
+  total, and ZERO transitive packages: `libsqlite3-0`, `libreadline8t64`,
+  `zlib1g`, `libsmartcols1` and `libtinfo6` are each already in the image
+  (verified with `dpkg-query`, all five `install ok installed`), so nothing new
+  is pulled under `--no-install-recommends`. Package names were verified with
+  `apt-cache` and `dpkg -S` on a real trixie host rather than assumed, which
+  caught two traps: `dc` is a SEPARATE binary package from `bc` on Debian, and
+  `column` ships in `bsdextrautils`, not in the pre-bullseye `bsdmainutils`.
+  `sqlite3` is the one that was genuinely missing rather than merely absent —
+  MemPalace stores both the palace and the logstream as SQLite files
+  (`palace/chroma.sqlite3`, `logstream.sqlite3`) and `mempalace_status` reports a
+  `sqlite_integrity` block, so every integrity check on this fleet had been done
+  through a `python3 -c` one-liner. `bc`/`dc` are frankly low value on their own
+  (`awk`, `python3` and `perl` are all already baked and each is strictly more
+  capable) and are here only because copy-pasted shell snippets assume `bc`
+  exists; the incident that prompted the request was NOT `bc` being absent but
+  `printf '%6.2f'` rendering the missing tool's empty output as a confident
+  `0.00 days` for a figure that was really 4.81 days. Declined at the same time:
+  `datamash` and `xsv`/`csvkit`, because Python's stdlib `csv` module correctly
+  handled a real 7-file Excel-export concatenation (BOM, CRLF, embedded newlines
+  inside quoted fields) without them.
+
 ### Fixed
 
 - **`git push` from inside the container dies on a read-only ControlPath, and no