worker: make/jq/gopls in base image + per-repo .lvmh/setup.sh hook (agent-driven persistent setup)

docker/README.md

@@ -0,0 +1,28 @@
+# docker/ — worker image & bridge
+
+## lvmh-worker image (`worker.Dockerfile`)
+
+Headless pi worker: node 24, pi (global npm), golang, git, ripgrep, make, jq,
+gopls, plus the user's pi config baked from dotfiles (`deploy/rsync-pi-agent.sh`:
+settings/skills/agents/extensions; no auth.json/sessions/cache; `git:` packages
+dropped — postinstalls crash headless installs).
+
+## Per-repo setup hook (agent-driven image setup)
+
+The agent works as root with network access, so it can `apt-get install` /
+`go install` anything **in-session**. Containers are ephemeral, so system
+packages vanish on container stop. For durability, a repo can ship:
+
+    /workspace/.lvmh/setup.sh
+
+The bridge (`bridge/index.mjs`) runs it with bash on **every spawn** before the
+pi session starts (10-min timeout, failure is non-fatal — logged, session
+continues). Since `/workspace` is a persistent per-repo volume, the hook
+survives container death. Agents that need extra tooling should write that
+script into the repo (e.g. `apt-get update && apt-get install -y sqlite3`).
+
+## bridge/index.mjs
+
+Hosts the SDK session (`createAgentSession` + `bindExtensions({mode:"rpc"})` —
+the SDK never fires `session_start` without the explicit bind, and the lvmh
+plugin dials home off that event).