feat: full pi config in containers — git: packages vendored at bake (ignore-scripts), npm shim for runtime installs, dotfiles mount + POST /api/pi-config/resync rebuilds worker+ops images (95% cover, race clean)

docker/npm-shim

@@ -0,0 +1,16 @@
+#!/bin/sh
+# npm shim for headless pi containers: skip lifecycle scripts during package
+# installs. pi installs git: packages by running `npm install --omit=dev` in
+# each clone; some upstream packages (e.g. husky in rpiv-mono) have
+# postinstall scripts that assume a dev machine and fail/crash headless
+# installs. --ignore-scripts makes installs safe; runtime code (pure TS/JS
+# extensions) does not need lifecycle scripts. Everything else passes through
+# to the real npm transparently.
+case "$1" in
+  install|i)
+    exec /usr/bin/npm-real "$@" --ignore-scripts
+    ;;
+  *)
+    exec /usr/bin/npm-real "$@"
+    ;;
+esac