worker: bake dotfiles pi config (filtered) + shared lvmh-pi-cache volume; CopyToContainer seeding

deploy/deploy.sh

@@ -19,6 +19,9 @@ if [ ! -f web/dist/index.html ]; then
 	(cd web && bun install && bun run build)
 fi
 
+# Bake the user's pi config (dotfiles) into the worker image context.
+bash "$(dirname "$0")/rsync-pi-agent.sh"
+
 rsync -az --delete \
 	--exclude .git --exclude node_modules --exclude web/node_modules \
 	--exclude .env --exclude .scratch --exclude .pi --exclude coverage \

deploy/rsync-pi-agent.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Sync the user's pi config (from dotfiles) into docker/pi-agent/ so the
+# worker image bakes it. Filtered: no secrets, no machine-local state.
+set -euo pipefail
+
+SRC="${LVMH_PI_AGENT_DIR:-$HOME/.dotfiles/pi/agent}"
+DEST="$(dirname "$0")/../docker/pi-agent"
+
+if [ ! -f "$SRC/settings.json" ]; then
+  echo "rsync-pi-agent: $SRC/settings.json not found — skipping dotfiles sync" >&2
+  exit 0
+fi
+
+mkdir -p "$DEST"
+rsync -a --delete \
+  --exclude 'auth.json' \
+  --exclude 'models.json' \
+  --exclude 'models-store.json' \
+  --exclude 'sessions/' \
+  --exclude 'cache/' \
+  --exclude 'npm/' \
+  --exclude 'git/' \
+  --exclude 'trust.json' \
+  --exclude 'mcp-*' \
+  --exclude 'run-history*' \
+  --exclude 'vibes/' \
+  --exclude '*.log' \
+  --exclude 'scratch/' \
+  --exclude '.pi/' \
+  "$SRC/" "$DEST/"
+echo "rsync-pi-agent: synced $(find "$DEST" -type f | wc -l) files from $SRC"