[noelo]

Ports the pi-harness work from traust-scan@01ff871 ("Add pi harness to toolchain image: node 22 + pi-coding-agent, baked skills, env-driven model config") into this repo.

What's included

• pi-models.json / pi-setup.sh — verbatim from the source commit. OpenAI-compatible model endpoints configured from $MODEL_BASE_URL (endpoint) + $LLMAPIKEY (key, interpolated by pi itself); pi-setup writes the agent-dir models.json from the template at runtime so baseUrl substitution works (pi does not env-interpolate baseUrl).
• Containerfile.toolkit-plus-feeds — this repo's toolchain image is the equivalent of the source repo's toolchain Dockerfile (which has no Dockerfile here), so the pi-harness section landed there as a HARNESS=pi option:
  • node already covered by the existing nodejs:22 dnf module when HARNESS != none (the source commit's _build/node tarball was a traust-scan egress workaround, not needed here)
  • npm install -g --ignore-scripts @earendil-works/pi-coding-agent for HARNESS=pi
  • ENV PI_CODING_AGENT_DIR=/opt/pi-agent with skills baked from the traust checkout's harnessing tree ($TRAUST_WORKSPACE/traust/harnessing — verified against bootstrap.State.TraustRepo() = Workspace/traust and cmd/worker_test.go), copying every SKILL.md dir flat (stage-nested + cross-cutting)
  • pi-models.json copied as models.json.tmpl, pi-setup.sh to /usr/local/bin/pi-setup, world-writable agent dir
• pi is already a first-class adapter (internal/harness/pi.go), so init --harness pi / run --harness pi work with no CLI changes.

Credentials are never baked: only the binary + template; $MODEL_BASE_URL comes from the harness credentials Secret at runtime.