fix: pi container repo mount target and npm update permissions

- Add Alembic migration to update built-in pi-agent manifest:
  * repo mount target from /workspace to ~/{{WORKSPACE_NAME}}
  * keep /workspace as compatibility symlink via working_dir
  * update startup chown target to $HOME/$WORKSPACE_NAME
- Pass REPO_NAME and WORKSPACE_NAME to compile_compose from instance_service
- Substitute {{WORKSPACE_NAME}} in manifest mount targets and expose it as
  a container env var so the entrypoint can create the /workspace symlink
- Generate entrypoint workspace symlink from runtime WORKSPACE_NAME env var
- Install npm_global packages into {home_dir}/.npm-global with PATH so the
  non-root container user can update global packages
- Update manifest compiler unit tests for the new behavior

Quality gates:
- pytest tests/unit: 207 passed
- ruff: clean on changed files
- mypy: clean on changed files
- alembic heads: single head

openspec/changes/fix-pi-container-mount-permissions/.pi-map.md

@@ -0,0 +1,20 @@
+# openspec/changes/fix-pi-container-mount-permissions
+dir: openspec/changes/fix-pi-container-mount-permissions
+
+index: openspec/changes/fix-pi-container-mount-permissions/.pi-map.index.md
+
+## role
+Documents a bug fix for resolving permission issues with Pi container repository mounts and npm updates in a development environment.
+## files
+- change.md | Documents a bug fix for pi-agent container repository mounting and npm update permissions in a development environment system. | dep: Alembic, manifest_compiler.py, instance_service.py, pytest, ruff, mypy, npm
+- tasks.md | Tracks completion status of tasks for fixing a Pi container repository mount and npm update permissions issue
+## arch
+Simple documentation-based change tracking using markdown files for issue description (change.md) and task checklist (tasks.md) without code implementation.
+## tags
+npm, tasks, container, repository, update, permissions, py, change
+## symbols
+-
+## workflows
+-
+## dirty
+-