Install pi-claude-code-provider on first container start

The Pi coding agent stores installed packages under $PI_CODING_AGENT_DIR
(=/pi-agent in the image), which is a volume — so anything installed at
build time is masked at runtime. Wrap the CMD in an entrypoint that runs
`pi install npm:pi-claude-code-provider` the first time the volume is
seen and drops a marker so subsequent starts are a no-op.

.gitignore

@@ -7,3 +7,4 @@ workspace/inbox/*
 workspace/scripts/*
 !workspace/scripts/.gitkeep
 workspace/.secretary/
+deploy.json

Dockerfile

@@ -11,9 +11,12 @@ COPY tsconfig.json tsconfig.build.json ./
 COPY src ./src
 RUN npm run build && npm prune --omit=dev
 
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
 ENV NODE_ENV=production \
     WORKSPACE_DIR=/workspace \
     PI_CODING_AGENT_DIR=/pi-agent
 VOLUME ["/workspace", "/pi-agent"]
 
-CMD ["node", "dist/main.js"]
+CMD ["/usr/local/bin/docker-entrypoint.sh"]

docker-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+PI_DIR="${PI_CODING_AGENT_DIR:-/pi-agent}"
+MARKER="$PI_DIR/.pi-claude-code-provider.installed"
+
+if [ ! -f "$MARKER" ]; then
+  echo "[entrypoint] pi install npm:pi-claude-code-provider"
+  mkdir -p "$PI_DIR"
+  if /app/node_modules/.bin/pi install npm:pi-claude-code-provider; then
+    touch "$MARKER"
+  else
+    echo "[entrypoint] pi install failed; will retry on next start" >&2
+  fi
+else
+  echo "[entrypoint] pi-claude-code-provider already installed"
+fi
+
+exec node dist/main.js