fix: rm npm symlink before installing shim (COPY followed it and clobbered npm-cli.js)

docker/control.Dockerfile

@@ -14,8 +14,12 @@ RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
 
 # Same npm shim as the worker image (see worker.Dockerfile).
 COPY docker/npm-real /usr/local/bin/npm-real
-COPY docker/npm-shim /usr/local/bin/npm
-RUN chmod +x /usr/local/bin/npm-real /usr/local/bin/npm
+COPY docker/npm-shim /usr/local/bin/npm-ignore-scripts
+# rm first: /usr/local/bin/npm is a symlink into npm's lib dir, and COPY
+# would follow it and clobber npm-cli.js itself.
+RUN rm -f /usr/local/bin/npm \
+	&& mv /usr/local/bin/npm-ignore-scripts /usr/local/bin/npm \
+	&& chmod +x /usr/local/bin/npm-real /usr/local/bin/npm
 
 # Same pi config as workers (dotfiles, filtered; git: packages stripped).
 COPY docker/pi-agent/ /root/.pi/agent/

docker/worker.Dockerfile

@@ -18,8 +18,12 @@ RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
 # --ignore-scripts so ALL dotfiles packages (pi-subagents, todo tooling,
 # async agents, every extension) survive the bake.
 COPY docker/npm-real /usr/local/bin/npm-real
-COPY docker/npm-shim /usr/local/bin/npm
-RUN chmod +x /usr/local/bin/npm-real /usr/local/bin/npm
+COPY docker/npm-shim /usr/local/bin/npm-ignore-scripts
+# rm first: /usr/local/bin/npm is a symlink into npm's lib dir, and COPY
+# would follow it and clobber npm-cli.js itself.
+RUN rm -f /usr/local/bin/npm \
+	&& mv /usr/local/bin/npm-ignore-scripts /usr/local/bin/npm \
+	&& chmod +x /usr/local/bin/npm-real /usr/local/bin/npm
 
 # User's pi config from dotfiles (settings, skills, agents, extensions,
 # APPEND_SYSTEM.md) — synced by deploy.sh from ~/.dotfiles/pi/agent (filtered: