worker: bake dotfiles pi config (filtered) + shared lvmh-pi-cache volume; CopyToContainer seeding

deploy/rsync-pi-agent.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Sync the user's pi config (from dotfiles) into docker/pi-agent/ so the
+# worker image bakes it. Filtered: no secrets, no machine-local state.
+set -euo pipefail
+
+SRC="${LVMH_PI_AGENT_DIR:-$HOME/.dotfiles/pi/agent}"
+DEST="$(dirname "$0")/../docker/pi-agent"
+
+if [ ! -f "$SRC/settings.json" ]; then
+  echo "rsync-pi-agent: $SRC/settings.json not found — skipping dotfiles sync" >&2
+  exit 0
+fi
+
+mkdir -p "$DEST"
+rsync -a --delete \
+  --exclude 'auth.json' \
+  --exclude 'models.json' \
+  --exclude 'models-store.json' \
+  --exclude 'sessions/' \
+  --exclude 'cache/' \
+  --exclude 'npm/' \
+  --exclude 'git/' \
+  --exclude 'trust.json' \
+  --exclude 'mcp-*' \
+  --exclude 'run-history*' \
+  --exclude 'vibes/' \
+  --exclude '*.log' \
+  --exclude 'scratch/' \
+  --exclude '.pi/' \
+  "$SRC/" "$DEST/"
+echo "rsync-pi-agent: synced $(find "$DEST" -type f | wc -l) files from $SRC"