fix: worker auth.json bind must use HOST path (docker.sock resolves bind sources on the host, not in the daemon container)

docker-compose.yml

@@ -16,8 +16,9 @@ services:
       LVMH_CONTAINER_LVMH_URL: ws://lvmh:8686/agent/ws
       GITLAB_BASE_URL: https://git.westphal.fr
       # host path of the pi config, so spawned containers can bind auth.json
-      # daemon-internal path of the read-only dotfiles mount (see volumes)
-      LVMH_HOST_PI_AGENT_DIR: /pi-dotfiles
+      # docker.sock bind semantics: bind sources resolve on the HOST, so
+      # this must be the HOST path of the pi config (auth.json etc.).
+      LVMH_HOST_PI_AGENT_DIR: ${LVMH_PI_AGENT_DIR:-/home/alarm/.dotfiles/pi/agent}
       OPENAI_API_KEY: ${OPENAI_API_KEY:-}
       GEMINI_API_KEY: ${GEMINI_API_KEY:-}
       DEEPSEEK_KEY: ${DEEPSEEK_KEY:-}