fix: remove explicit repo mount from pi-agent manifest and derive workspace name from remote URL

The pi-agent manifest still declared an explicit repo mount with
{{WORKSPACE_NAME}}, making the mount target dependent on tool config. The
instance service now synthesizes the repo mount, so the manifest no longer
needs the explicit mount.

- Add Alembic migration 2026_06_15_090500 to remove the source_type: repo
  mount from the built-in pi-agent manifest
- Add _get_repository_mount_name() helper to derive the workspace directory
  name from the repository remote URL (matching git clone behavior) and
  fall back to the user-provided repository name
- Use the helper for WORKSPACE_NAME/REPO_NAME in manifest, legacy dockerfile,
  and legacy compose template paths
- Update unit tests for the new migration and helper

Quality gates:
- pytest tests/unit: 218 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

openspec/changes/fix-pi-container-mount-permissions/tasks.md

@@ -4,6 +4,8 @@
 - [x] Create Alembic data migration to update pi-agent manifest
 - [x] Update manifest_compiler.py: {{WORKSPACE_NAME}} substitution, env var, entrypoint runtime var, npm prefix
 - [x] Update instance_service.py to pass REPO_NAME/WORKSPACE_NAME
+- [x] Remove explicit repo mount from pi-agent manifest; synthesize mount in compile_compose
+- [x] Add _get_repository_mount_name() helper to derive workspace name from remote URL
 - [x] Update unit tests
 - [x] Run quality gates (pytest unit, ruff, mypy)
 - [ ] Commit and push