feat: implement configurable tool container home directory

- Add ToolType.home_directory column with default /home/user
- Add Alembic migration to add column, set existing rows, and rewrite
  /workspace to /home/user/{{WORKSPACE_NAME}} in legacy templates
- Add merge migration fc8f1a20cbf6 to resolve Alembic multiple heads
- Update manifest compiler to honor manifest.home_directory for HOME,
  WORKDIR, /workspace symlink, and default repo mount target
- Update legacy dockerfile/compose instance generation to use
  tool_type.home_directory
- Thread resolved home_dir through config profile and git mount expansion
- Generate entrypoint permission fixer to chown home/mounts at startup
- Update base.dockerfile with sudo/passwordless sudo for permission fixer
- Add unit tests for manifest compiler, instance service, and migrations
- Add placeholder integration test for container lifecycle
- Update openspec/tasks/home-path-expansion.md task checkboxes
- Update project maps for modified files

Quality gates: py_compile, ruff, mypy, pytest tests/unit (205 passed),
pytest tests/integration (110 passed, 35 skipped). Alembic round-trip
and container lifecycle integration tests require Docker/PostgreSQL.

tool-images/.pi-map.index.md

@@ -2,7 +2,7 @@
 dir: tool-images
 
 ## role
-Provides Docker image templates for various development environment types used in the Headquarter platform.
+Provides containerized development environment templates for AI coding agents and IDE tools used in the Headquarter platform.
 ## parent
 index: ./.pi-map.index.md
 map: ./.pi-map.md

tool-images/.pi-map.md

@@ -4,16 +4,16 @@ dir: tool-images
 index: tool-images/.pi-map.index.md
 
 ## role
-Provides Docker image templates for various development environment types used in the Headquarter platform.
+Provides containerized development environment templates for AI coding agents and IDE tools used in the Headquarter platform.
 ## files
 - README.md | Documents a directory of Dockerfile templates for base tool types used in the Headquarter platform | dep: Docker, git, neovim, ranger, tmux, htop, tree, jq, Node.js 20, Pi Coding Agent
-- base.dockerfile | Defines a base Docker image for development environments with common CLI tools, Node.js, and a non-root user setup. | dep: ubuntu:24.04, curl, wget, git, neovim, ranger, tmux, htop, tree, jq, ca-certificates, nodejs
+- base.dockerfile | Defines a base Docker development image with common CLI tools, Node.js, and a non-root user with sudo privileges for bind-mounted directory permission fixes. | dep: ubuntu:24.04, curl, wget, git, neovim, ranger, tmux, htop, tree, jq, ca-certificates, sudo, nodejs
 - code-server.dockerfile | Builds a Docker image for browser-based VS Code with additional development tools and Node.js | dep: linuxserver/code-server, git, neovim, ranger, tmux, htop, tree, jq, Node.js 20
 - jupyter.dockerfile | Builds a Docker image for Jupyter Notebook/Lab with additional CLI tools and git configuration | dep: jupyter/scipy-notebook, apt, git, neovim, ranger, tmux, htop, tree, jq
 - opencode.dockerfile | Builds a Docker container for running the OpenCode AI agent as a server | dep: ubuntu:24.04, nodejs, npm, python3, git, opencode
 - pi-agent.dockerfile | Builds a Docker container providing a terminal-based development environment with the Pi coding agent and supporting tools (neovim, tmux, ranger, etc.) | dep: ubuntu:24.04, nodejs, npm, @earendil-works/pi-coding-agent, git, tmux, neovim, ranger, python3, build-essential
 ## arch
-Template-based container architecture with layered Dockerfiles extending a common base image pattern for specialized IDE, notebook, and AI agent environments.
+Multi-flavored Dockerfile pattern with shared base layer (common CLI tools, Node.js, non-root user) and specialized downstream images for distinct tool types (VS Code, Jupyter, OpenCode, Pi agent).
 ## tags
 git, docker, neovim, ranger, tmux, agent, base, htop
 ## symbols

tool-images/base.dockerfile

@@ -4,7 +4,8 @@ FROM ubuntu:24.04
 # Prevent interactive prompts during apt install
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Install base tools
+# Install base tools plus sudo so the entrypoint permission fixer can
+# chown runtime mounts staged by the API before dropping to the user.
 RUN apt-get update && apt-get install -y \
     curl \
     wget \
@@ -16,10 +17,14 @@ RUN apt-get update && apt-get install -y \
     tree \
     jq \
     ca-certificates \
+    sudo \
     && rm -rf /var/lib/apt/lists/*
 
-# Create a non-root user
-RUN useradd -m -s /bin/bash user
+# Create a non-root user and allow passwordless sudo so the startup
+# permission fixer can adjust ownership of bind-mounted directories.
+RUN useradd -m -s /bin/bash user \
+    && echo "user ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/user \
+    && chmod 0440 /etc/sudoers.d/user
 WORKDIR /home/user
 
 # Install Node.js (needed for pi and many dev tools)