fix: pi container repo mount target and npm update permissions

- Add Alembic migration to update built-in pi-agent manifest:
  * repo mount target from /workspace to ~/{{WORKSPACE_NAME}}
  * keep /workspace as compatibility symlink via working_dir
  * update startup chown target to $HOME/$WORKSPACE_NAME
- Pass REPO_NAME and WORKSPACE_NAME to compile_compose from instance_service
- Substitute {{WORKSPACE_NAME}} in manifest mount targets and expose it as
  a container env var so the entrypoint can create the /workspace symlink
- Generate entrypoint workspace symlink from runtime WORKSPACE_NAME env var
- Install npm_global packages into {home_dir}/.npm-global with PATH so the
  non-root container user can update global packages
- Update manifest compiler unit tests for the new behavior

Quality gates:
- pytest tests/unit: 207 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

openspec/.pi-map.index.md

@@ -1,52 +1,39 @@
-# . (index)
-dir: .
-
-## Project Map Protocol
-
-1. Read this protocol and the root `.pi-map.index.md` first.
-2. Use `index:` / `map:` references to open relevant directory indexes and maps.
-3. Load indexes before rich maps during task-start navigation.
-4. Read the local rich map and actual source before editing.
-5. Treat non-empty `## dirty` sections in either artifact as stale.
-6. If source and generated artifacts disagree, trust source.
-7. If map and index disagree, trust neither blindly; verify from source and regenerate the pair.
-8. After editing source, run `project_map_patch` for each changed file.
-9. Before broad architectural claims or final handoff, run `project_map_validate` when freshness matters.
-
-Trust boundary: index routes, map orients, source decides.
+# openspec (index)
+dir: openspec
 
 ## role
-Defines a living documentation methodology and project configuration for managing software requirements, specifications, and development discipline rules within a Docker-based coding agent platform.
+Defines a living documentation methodology and configuration for managing software requirements, specifications, and development workflows within a project repository.
 ## parent
--
+index: ./.pi-map.index.md
+map: ./.pi-map.md
 ## children
-- changes
-  index: changes/.pi-map.index.md
-  map: changes/.pi-map.md
-- designs
-  index: designs/.pi-map.index.md
-  map: designs/.pi-map.md
-- docs
-  index: docs/.pi-map.index.md
-  map: docs/.pi-map.md
-- explorations
-  index: explorations/.pi-map.index.md
-  map: explorations/.pi-map.md
-- proposals
-  index: proposals/.pi-map.index.md
-  map: proposals/.pi-map.md
-- specs
-  index: specs/.pi-map.index.md
-  map: specs/.pi-map.md
-- tasks
-  index: tasks/.pi-map.index.md
-  map: tasks/.pi-map.md
+- openspec/changes
+  index: openspec/changes/.pi-map.index.md
+  map: openspec/changes/.pi-map.md
+- openspec/designs
+  index: openspec/designs/.pi-map.index.md
+  map: openspec/designs/.pi-map.md
+- openspec/docs
+  index: openspec/docs/.pi-map.index.md
+  map: openspec/docs/.pi-map.md
+- openspec/explorations
+  index: openspec/explorations/.pi-map.index.md
+  map: openspec/explorations/.pi-map.md
+- openspec/proposals
+  index: openspec/proposals/.pi-map.index.md
+  map: openspec/proposals/.pi-map.md
+- openspec/specs
+  index: openspec/specs/.pi-map.index.md
+  map: openspec/specs/.pi-map.md
+- openspec/tasks
+  index: openspec/tasks/.pi-map.index.md
+  map: openspec/tasks/.pi-map.md
 ## files
 - README.md
 - config.yaml
 ## links
-index: ./.pi-map.index.md
-map: ./.pi-map.md
+index: openspec/.pi-map.index.md
+map: openspec/.pi-map.md
 ## workflows
 -
 ## dirty