fix: use Pi user auth and handle startup failures

scripts/bootstrap-local-psd-docker-config.sh

@@ -39,6 +39,7 @@ MAX_PI_PROCESSES=4
 PI_PROVIDER=zai
 PI_MODEL=glm-5.2
 PI_THINKING=medium
+PI_AUTH_FILE=$auth_file
 THT_PROFILE=workstation
 THT_DB_NAME=$(required THT_DB_NAME)
 THT_DWH_REST_URL=$(required THT_DWH_REST_URL)

scripts/test-pi-user-auth-compose.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+auth_file="$tmp/auth.json"
+printf '%s\n' '{}' >"$auth_file"
+chmod 0600 "$auth_file"
+
+rendered=$(PI_AUTH_FILE="$auth_file" docker compose config)
+printf '%s\n' "$rendered" | grep -q "source: $auth_file"
+printf '%s\n' "$rendered" | grep -q 'target: /home/thoth/.pi/agent/auth.json'
+printf '%s\n' "$rendered" | grep -A4 'target: /home/thoth/.pi/agent/auth.json' \
+  | grep -q 'read_only: true'
+
+python3 - <<'PY'
+import json
+from pathlib import Path
+
+settings = json.loads(Path("deploy/pi/settings.json").read_text())
+assert settings["enabledModels"] == [
+    "zai/glm-5.2",
+    "deepseek/deepseek-v4-flash",
+    "deepseek/deepseek-v4-pro",
+    "aritmolab/qwen3.6-35b-a3b",
+]
+PY
+
+grep -q '^ARG PI_VERSION=0.80.3$' docker/core.Dockerfile
+grep -q '^PI_AUTH_FILE=$auth_file$' scripts/bootstrap-local-psd-docker-config.sh
+
+echo "Pi user-auth Compose contract passed."