feat: harden runtime readiness and session workflow

docker/core-entrypoint.sh

@@ -5,6 +5,11 @@
 set -euo pipefail
 export THT_CONFIG="${THT_CONFIG:-/app/harness/workspaces/local.yaml}"
 
+# Pi 0.80 gates every project-local extension, prompt and skill behind its persistent
+# trust store. The mounted profile may come from another host and therefore not contain
+# the container path. Preserve its existing decisions and authorize only this harness.
+node /app/docker/ensure-pi-trust.mjs "${THT_HARNESS_DIR:-/app/harness}"
+
 cmd="${1:-server}"
 case "$cmd" in
   server)