Dockerfile.base: LABEL se.jordbo.pi-devbox.mempalace-version, inherited by both variants

Closes the blind spot check 9 (cb6d9e5) named: no label recorded the palace
pin, so a MEMPALACE_VERSION bump — the one component whose skew against the
shared central palace is fleet-wide — could ship without a CHANGELOG line.

In Dockerfile.base, not Dockerfile.variant, deliberately: the value sits next
to the ARG that defines it (a copy in the variant is one more pin able to
drift); labels are inherited by every image built FROM the base, so no
build-arg to plumb through the variant's four call sites; and inheritance
means the label states the pin of the base the image ACTUALLY built on,
which is the question when base-decide cache-hits an older base. Both
mechanisms measured on the published v1.9.2 config blob rather than assumed:
maintainer + image.source (set only in Dockerfile.base) are present on the
variant image, and pi-version=0.85.1 is an ARG expanded inside a LABEL.

Intent, like every se.jordbo.pi-devbox.* label; the manifest's
mempalace_version (read from the installed binary) stays the ground truth,
and smoke-test.sh now asserts label == installed core — the one way they
diverge is a base built with INSTALL_MEMPALACE=false or an off-pin install,
both invisible to a label-only check.

check-doc-drift check 9 gains the component (literal, against
ARG MEMPALACE_VERSION in Dockerfile.base); the label-key rule generalises to
"names ending in -version are the label itself". Until a release carries the
label it reports a counted SKIP, not OK — measured: "v1.9.2 carries no
se.jordbo.pi-devbox.mempalace-version label", summary says 1 SKIPPED.

Costs nothing extra: this Unreleased already forces a base rebuild
(50153e6 rootfs/ skill floor). check-base-hash unchanged (no new *_REF).

AGENTS.md

@@ -111,7 +111,9 @@ re-brand of opencode-devbox's `pi-only` variant.
    `git ls-remote`s each floating `*_REF`. A red check 9 means an upstream
    (pi-toolkit, pi-extensions, mempalace-toolkit, pi-fork,
    pi-observational-memory, pi-studio) moved and no entry names the new SHA;
-   the failure prints the compare URL. Name the 7-char SHA where you describe
+   the failure prints the compare URL; a `PI_VERSION` or `MEMPALACE_VERSION`
+   bump is caught the same way via the `pi-version` / `mempalace-version`
+   labels. Name the 7-char SHA (or version) where you describe
    the change — that is what the old "Dependency audit" tables recorded by
    hand, now required.