Dockerfile.base: LABEL se.jordbo.pi-devbox.mempalace-version, inherited by both variants

Closes the blind spot check 9 (cb6d9e5) named: no label recorded the palace
pin, so a MEMPALACE_VERSION bump — the one component whose skew against the
shared central palace is fleet-wide — could ship without a CHANGELOG line.

In Dockerfile.base, not Dockerfile.variant, deliberately: the value sits next
to the ARG that defines it (a copy in the variant is one more pin able to
drift); labels are inherited by every image built FROM the base, so no
build-arg to plumb through the variant's four call sites; and inheritance
means the label states the pin of the base the image ACTUALLY built on,
which is the question when base-decide cache-hits an older base. Both
mechanisms measured on the published v1.9.2 config blob rather than assumed:
maintainer + image.source (set only in Dockerfile.base) are present on the
variant image, and pi-version=0.85.1 is an ARG expanded inside a LABEL.

Intent, like every se.jordbo.pi-devbox.* label; the manifest's
mempalace_version (read from the installed binary) stays the ground truth,
and smoke-test.sh now asserts label == installed core — the one way they
diverge is a base built with INSTALL_MEMPALACE=false or an off-pin install,
both invisible to a label-only check.

check-doc-drift check 9 gains the component (literal, against
ARG MEMPALACE_VERSION in Dockerfile.base); the label-key rule generalises to
"names ending in -version are the label itself". Until a release carries the
label it reports a counted SKIP, not OK — measured: "v1.9.2 carries no
se.jordbo.pi-devbox.mempalace-version label", summary says 1 SKIPPED.

Costs nothing extra: this Unreleased already forces a base rebuild
(50153e6 rootfs/ skill floor). check-base-hash unchanged (no new *_REF).

scripts/check-doc-drift.sh

@@ -414,7 +414,9 @@ fi
 #    a tag or branch is `git ls-remote`d (peeled `^{}` first -- an annotated
 #    tag's un-dereferenced SHA is the tag object, a false alarm this repo has
 #    already fallen for once), pi-studio is the highest semver tag, and
-#    `PI_VERSION` is compared as a literal against the `pi-version` label.
+#    `PI_VERSION` / `MEMPALACE_VERSION` are compared as literals against the
+#    `pi-version` / `mempalace-version` labels (the latter set in Dockerfile.base
+#    and inherited; absent on releases before it shipped, which reports SKIP).
 #
 #    The rule: baked == would-bake is OK with no mention required. If they
 #    differ, the text ABOVE the last published version's `## ` heading -- i.e.
@@ -472,7 +474,8 @@ pi-atelier|ref|$ATELIER_REPO|$ATELIER_ACTUAL
 mempalace-toolkit|ref|$MPTK_REPO|$MPTK_REF
 pi-studio|studio|$STUDIO_REPO|
 skillset-snapshot|literal||$SKILLSET_SNAPSHOT
-pi-version|literal||$PI_ACTUAL"
+pi-version|literal||$PI_ACTUAL
+mempalace-version|literal||$MEMPALACE_ACTUAL"
   REF_RC=0
   # Same discipline as check 8: no `|| true` on the python, or a printed DRIFT
   # exits 0. Per-component SKIP lines are counted afterwards by grep, so a run
@@ -600,7 +603,9 @@ for line in os.environ["COMPONENTS"].splitlines():
     if not line.strip():
         continue
     name, kind, url, ref = line.split("|", 3)
-    key = LABEL + name if name == "pi-version" else LABEL + name + "-ref"
+    # <name>-ref labels hold SHAs; names that already end in -version are the
+    # label (pi-version, mempalace-version) -- a version string, compared literally.
+    key = LABEL + name if name.endswith("-version") else LABEL + name + "-ref"
     try:
         if kind == "studio":
             if studio_labels is None:

scripts/smoke-test.sh

@@ -597,6 +597,19 @@ if [ -n "$LBL" ] && [ "$LBL" != "<no value>" ]; then
 else
   printf "  ❌  OCI label se.jordbo.pi-devbox.pi-extensions-ref missing or empty\n"; FAIL=$((FAIL+1))
 fi
+# mempalace-version is set in Dockerfile.base and INHERITED by the variant, so
+# it states the pin of the base this image actually built on. It must equal the
+# installed binary: the one way they diverge is a base built with
+# INSTALL_MEMPALACE=false (label says 3.x, nothing installed) or an install that
+# resolved to something other than the pin — both invisible to a label-only
+# check. Same ground-truth rule as the manifest assertion above.
+MP_LBL=$(docker inspect --format '{{ index .Config.Labels "se.jordbo.pi-devbox.mempalace-version" }}' "$IMAGE" 2>/dev/null || true)
+MP_BIN=$(docker run --rm --entrypoint= "$IMAGE" sh -c 'mempalace --version 2>/dev/null | head -n1 | tr -d "\r"' 2>/dev/null || true); MP_BIN=${MP_BIN##* }
+if [ -n "$MP_LBL" ] && [ "$MP_LBL" != "<no value>" ] && [ "$MP_LBL" = "$MP_BIN" ]; then
+  printf "  ✅  OCI label se.jordbo.pi-devbox.mempalace-version=%s equals the installed core\n" "$MP_LBL"; PASS=$((PASS+1))
+else
+  printf "  ❌  OCI label se.jordbo.pi-devbox.mempalace-version=[%s] vs installed mempalace=[%s]\n" "$MP_LBL" "$MP_BIN"; FAIL=$((FAIL+1))
+fi
 
 # ── Runtime deployment (needs entrypoint to run) ──────────────────────
 echo ""