fix(docker): publish spawn-pi image so --beta sandbox works for pi (#3373)

The sandbox flow on local pulls ghcr.io/openrouterteam/spawn-<agent>:latest,
but the Docker build matrix in .github/workflows/docker.yml didn't include
`pi` and there was no sh/docker/pi.Dockerfile, so the image was never
published. `spawn pi local --beta sandbox` failed with "denied" pulling
spawn-pi:latest.

Adds the Dockerfile (mirrors kilocode/codex: Ubuntu 24.04 + Node 22 +
`npm install -g @mariozechner/pi-coding-agent`) and registers `pi` in
the workflow matrix. The next scheduled or manual run will publish
ghcr.io/openrouterteam/spawn-pi:latest.

Co-authored-by: A <258483684+la14-1@users.noreply.github.com>

.github/workflows/docker.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        agent: [claude, codex, cursor, openclaw, opencode, kilocode, hermes, junie]
+        agent: [claude, codex, cursor, openclaw, opencode, kilocode, hermes, junie, pi]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
 

sh/docker/pi.Dockerfile

@@ -0,0 +1,17 @@
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Base packages
+RUN apt-get update -y && \
+    apt-get install -y --no-install-recommends \
+      curl git ca-certificates build-essential unzip zsh && \
+    rm -rf /var/lib/apt/lists/*
+
+# Node.js 22 via n
+RUN curl --proto '=https' -fsSL https://raw.githubusercontent.com/tj/n/master/bin/n | bash -s install 22
+
+# Pi (pi-coding-agent)
+RUN npm install -g @mariozechner/pi-coding-agent
+
+CMD ["/bin/sleep", "inf"]