Install tilion-mcp and prefetch the Fortress engine in the Docker image

Dockerfile

@@ -16,6 +16,22 @@ RUN npm run build && npm prune --omit=dev
 # Adds ~300 MB to the image. Only Chromium — other browsers pull extra deps.
 RUN npx -y playwright install --with-deps chromium
 
+# Fortress stealth-browser MCP (FORTRESS_ENABLED=true). Isolated venv because
+# Debian's system Python is externally managed (PEP 668). "mcp<2": tilion 0.1.14
+# imports mcp.server.fastmcp, which mcp 2.x removed, and it doesn't pin mcp itself.
+# The engine bundle (~300 MB) is fetched at build time into FORTRESS_BROWSERS_PATH
+# so the first run doesn't download it; tilion_fortress skips the download when the
+# launcher is already there. Channel "latest" matches the FORTRESS_CHANNEL default
+# the bridge sets (the "stable" bundle doesn't launch, see src/agent/fortress-mcp.ts).
+# _download is private API: if it disappears, drop that line and the engine
+# downloads on first use instead.
+ENV FORTRESS_BROWSERS_PATH=/opt/fortress-browsers
+RUN apt-get update && apt-get install -y --no-install-recommends python3-venv \
+  && rm -rf /var/lib/apt/lists/* \
+  && python3 -m venv /opt/tilion \
+  && /opt/tilion/bin/pip install --no-cache-dir "tilion[mcp]" "mcp<2" \
+  && /opt/tilion/bin/python -c "import tilion_fortress as t; tag = t._CHANNELS['latest']['tag']; t._download('linux-x64', t._host(tag), tag)"
+
 # Claude Code CLI must be on PATH: pi-claude-code-provider shells out to `claude`.
 RUN npm install -g @anthropic-ai/claude-code
 
@@ -25,7 +41,7 @@ RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 # Expose `pi` (and any other project-local bin) on PATH so `docker exec` finds it.
 # PLAYWRIGHT_BROWSER=chromium matches the browser installed above — Playwright MCP
 # otherwise defaults to Chrome (the branded Google build), which isn't in the image.
-ENV PATH="/app/node_modules/.bin:${PATH}" \
+ENV PATH="/app/node_modules/.bin:/opt/tilion/bin:${PATH}" \
     NODE_ENV=production \
     WORKSPACE_DIR=/workspace \
     PI_CODING_AGENT_DIR=/pi-agent \