fix: pi container repo mount target and npm update permissions

- Add Alembic migration to update built-in pi-agent manifest:
  * repo mount target from /workspace to ~/{{WORKSPACE_NAME}}
  * keep /workspace as compatibility symlink via working_dir
  * update startup chown target to $HOME/$WORKSPACE_NAME
- Pass REPO_NAME and WORKSPACE_NAME to compile_compose from instance_service
- Substitute {{WORKSPACE_NAME}} in manifest mount targets and expose it as
  a container env var so the entrypoint can create the /workspace symlink
- Generate entrypoint workspace symlink from runtime WORKSPACE_NAME env var
- Install npm_global packages into {home_dir}/.npm-global with PATH so the
  non-root container user can update global packages
- Update manifest compiler unit tests for the new behavior

Quality gates:
- pytest tests/unit: 207 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

apps/api/src/services/tool/.pi-map.index.md

@@ -2,12 +2,14 @@
 dir: apps/api/src/services/tool
 
 ## role
-Orchestrates end-to-end deployment and runtime management of development tool instances via containerized environments with remote access capabilities.
+Provides containerized execution environment for tools by managing Docker instances, git repositories, and compose orchestration.
 ## parent
 index: apps/api/src/services/.pi-map.index.md
 map: apps/api/src/services/.pi-map.md
 ## children
--
+- apps/api/src/services/tool/.ruff_cache
+  index: apps/api/src/services/tool/.ruff_cache/.pi-map.index.md
+  map: apps/api/src/services/tool/.ruff_cache/.pi-map.md
 ## files
 - instance_service.py
 ## links
@@ -16,5 +18,7 @@ map: apps/api/src/services/tool/.pi-map.md
 ## workflows
 - change tool behavior
   read: instance_service.py
+- explore tool subdirectories
+  index: apps/api/src/services/tool/.ruff_cache/.pi-map.index.md
 ## dirty
 -

apps/api/src/services/tool/instance_service.py

@@ -880,12 +880,15 @@ async def prepare_manifest_instance(
             # The actual resolution happens in resolve_git_mounts; we store placeholder
             git_mount_vars[f"GIT_MOUNT_{ref}"] = ""
 
+    repo_name = os.path.basename(os.path.normpath(repo_path))
     variables = {
         "IMAGE_TAG": image_tag,
         "INSTANCE_NAME": instance.name.lower(),
         "INSTANCE_DIR": instance_dir,
         "WORKSPACE_PATH": repo_path,
         "REPO_PATH": repo_path,
+        "REPO_NAME": repo_name,
+        "WORKSPACE_NAME": repo_name,
         "SSH_PATH": ssh_path,
         "TOOL_PORT": instance.port or 0,
         "EXTRA_ENV": env_vars,
@@ -1070,12 +1073,15 @@ async def create_tool_instance(
 
         # Manifest templates use WORKSPACE_PATH; REPO_PATH is retained as a
         # deprecated alias for backward compatibility with older templates.
+        repo_name = os.path.basename(os.path.normpath(repo_path))
         variables = {
             "IMAGE_TAG": image_tag,
             "INSTANCE_NAME": instance_name.lower(),
             "INSTANCE_DIR": instance_dir,
             "WORKSPACE_PATH": repo_path,
             "REPO_PATH": repo_path,
+            "REPO_NAME": repo_name,
+            "WORKSPACE_NAME": repo_name,
             "SSH_PATH": "",
             "TOOL_PORT": tool_port,
             "EXTRA_ENV": {},