feat(skills): add mempalace proactive-load directive for containers

Baking the mempalace fallback skill fixed *availability*, but mempalace had
no proactive-load directive anywhere (pi-toolkit's global AGENTS.md only
points to pi-extensions), so a new container would still surface it only via
description-matching — the same under-utilisation the pi-extensions directive
was created to fix.

Add a session-start pointer to the pi-devbox managed AGENTS.md block
(pi-global-AGENTS.append.md): gated to pi-devbox containers and conditional on
the MemPalace MCP tools being present. Memory continuity matters most in a
frequently-recreated container — the palace is its only cross-recreate memory.

- pi-global-AGENTS.append.md: '## Session start: load the mempalace skill'.
- smoke-test: assert the pointer merges into the global AGENTS.md at build.
- docs: VENDORED.md, README, CHANGELOG [Unreleased].

Now both skills are complete in pi-devbox: directive + skill file.
pi-extensions = directive (pi-toolkit) + baked skill; mempalace = directive
(this block) + baked skill.

CHANGELOG.md

@@ -22,6 +22,15 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   the private `skillset` repo mounted. The image now bakes fallback copies of
   both skills under `/usr/local/share/pi-devbox/skills/`, symlinked in by
   `entrypoint-user.sh` (only when absent, so a mounted skillset still wins).
+- **Proactive-load directive for `mempalace`.** Baking the skill only fixes
+  *availability*; nothing in pi-toolkit's global `AGENTS.md` told sessions to
+  load it, so it would still surface only via description-matching. The
+  pi-devbox managed block (`pi-global-AGENTS.append.md`) now adds a
+  session-start pointer (gated to pi-devbox containers, conditional on the
+  MemPalace MCP tools being present) so a new container actually picks the
+  skill up — memory continuity matters most in a frequently-recreated
+  container. (`pi-extensions`'s directive already ships in pi-toolkit, so only
+  its skill file needed baking.)
 - **Layered freshness for the `pi-extensions` skill (Option 1 + Option 2).**
   The canonical skill was promoted into the **public `pi-extensions` package
   repo** under `skill/` (co-located with the extensions it documents). A

README.md

@@ -470,7 +470,10 @@ directory, and they compose:
   the pinned `pi-extensions` clone (`/opt/pi-extensions/skill/`) over it at
   build, so a normal build ships the fresh copy and an old-ref/mirror build
   still ships the snapshot. `mempalace` is snapshot-only (its consumer skill
-  has no public package home). See
+  has no public package home), and because pi-toolkit's `AGENTS.md` has no
+  directive for it, the pi-devbox managed block adds a session-start
+  *proactive-load* pointer for it (gated to pi-devbox containers, conditional
+  on the MemPalace MCP tools) so a new container actually loads it. See
   `rootfs/usr/local/share/pi-devbox/skills/VENDORED.md`.
 - **Skillset repo (optional).** If a `skillset` repo is mounted (at
   `$HOME/skillset` or `/workspace/skillset`, or via `SKILLSET_CONTAINER_PATH`),

rootfs/usr/local/share/pi-devbox/pi-global-AGENTS.append.md

@@ -18,3 +18,14 @@ be discovered at runtime, never assumed. And interactive shell aliases
 (`dssh`, `dscp`, `cat`→`bat`) do **not** exist in your non-interactive bash
 tool, so spell out the underlying command (e.g.
 `ssh -F "$HOME/.ssh-local/config" mac …`).
+
+## Session start: load the mempalace skill
+
+If MemPalace MCP tools (e.g. `mempalace_search`, `mempalace_diary_write`) are in
+your tool list, **read `~/.agents/skills/mempalace/SKILL.md` before doing
+non-trivial work** and follow its protocol: search the palace before answering
+about past work, and write a diary entry before the session ends. This is
+especially load-bearing here — a pi-devbox container is frequently recreated, so
+the palace is your only memory across recreates. Without the habit it is just
+storage, not memory. (The skill is the consumer side; feeding the palace is the
+separate `opencode-mempalace-bridge` skill, if present.)

rootfs/usr/local/share/pi-devbox/skills/VENDORED.md

@@ -16,9 +16,14 @@ override always wins).
 The pi-toolkit global `AGENTS.md` tells every pi session to read
 `~/.agents/skills/pi-extensions/SKILL.md` at start (to fix fork/recall
 under-utilisation). That pointer dangles in a container started **without** the
-private `skillset` repo mounted. Baking the skill closes that gap. `mempalace`
-is baked for the same reason (memory continuity), though nothing in `AGENTS.md`
-points to it directly.
+private `skillset` repo mounted. Baking the skill closes that *availability*
+gap. `mempalace` is baked for the same reason (memory continuity); since
+nothing in pi-toolkit's `AGENTS.md` points to it, the pi-devbox managed block
+(`pi-global-AGENTS.append.md`) also adds the matching *proactive-load*
+directive ("load the mempalace skill at session start") so a new container
+actually picks it up rather than relying on description-matching.
+`pi-extensions`'s directive already ships in pi-toolkit's `AGENTS.md`, so only
+its skill file needed baking.
 
 ## Freshness model (layered — see Dockerfile.variant)
 

scripts/smoke-test.sh

@@ -86,6 +86,8 @@ run "global-AGENTS append snippet present" \
     "test -f /usr/local/share/pi-devbox/pi-global-AGENTS.append.md"
 run "pi-devbox block merged into pi-global-AGENTS.md" \
     "grep -q 'pi-devbox:managed-block' /opt/pi-toolkit/pi-global-AGENTS.md"
+run "mempalace session-start pointer merged into global AGENTS.md" \
+    "grep -q 'load the mempalace skill' /opt/pi-toolkit/pi-global-AGENTS.md"
 # Vendored fallback skills (so a no-skillset container still resolves the
 # AGENTS.md 'read the pi-extensions skill' pointer).
 run "image-baked pi-extensions fallback skill" \