deploy: keep --ignore-scripts for vendored packages (prepare=husky is a devDep, fails either way)

deploy/rsync-pi-agent.sh

@@ -37,7 +37,7 @@ rsync -a --delete \
 # Keeps subagents/todo/async tooling present with no runtime network need.
 # Requires network access to github.com at bake time.
 python3 - "$DEST" <<'PY'
-import json, re, shutil, subprocess, sys
+import json, os, re, shutil, subprocess, sys
 from pathlib import Path
 
 dest = Path(sys.argv[1])
@@ -63,6 +63,8 @@ for pkg in settings.get("packages") or []:
     # existing installs; a stripped dir would fail resolution.
     if (target / "package.json").exists():
         npm = "/usr/bin/npm" if Path("/usr/bin/npm").exists() else "npm"
+        # --ignore-scripts: prepare scripts (husky) are devDependency-based
+        # and fail headless; extensions are plain TS needing runtime deps only.
         subprocess.run(
             [npm, "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"],
             cwd=target, check=True, capture_output=True,