fix: remove explicit repo mount from pi-agent manifest and derive workspace name from remote URL

The pi-agent manifest still declared an explicit repo mount with
{{WORKSPACE_NAME}}, making the mount target dependent on tool config. The
instance service now synthesizes the repo mount, so the manifest no longer
needs the explicit mount.

- Add Alembic migration 2026_06_15_090500 to remove the source_type: repo
  mount from the built-in pi-agent manifest
- Add _get_repository_mount_name() helper to derive the workspace directory
  name from the repository remote URL (matching git clone behavior) and
  fall back to the user-provided repository name
- Use the helper for WORKSPACE_NAME/REPO_NAME in manifest, legacy dockerfile,
  and legacy compose template paths
- Update unit tests for the new migration and helper

Quality gates:
- pytest tests/unit: 218 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

apps/api/tests/unit/test_alembic_migrations.py

@@ -47,3 +47,23 @@ def test_merge_migration_resolves_heads() -> None:
     assert "2026_06_14_104415" in module.down_revision
     assert "8c6d1dbd4798" in module.down_revision
     assert callable(module.upgrade)
+
+
+@pytest.mark.unit
+def test_remove_pi_agent_repo_mount_migration_imports() -> None:
+    migration_path = Path(__file__).parent.parent.parent / (
+        "alembic/versions/2026_06_15_090500_remove_pi_agent_explicit_repo_mount.py"
+    )
+    assert migration_path.exists()
+
+    spec = importlib.util.spec_from_file_location(
+        "remove_repo_mount_migration", migration_path
+    )
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+
+    assert module.revision == "2026_06_15_090500"
+    assert module.down_revision == "2026_06_14_182955"
+    assert callable(module.upgrade)
+    assert callable(module.downgrade)