feat(backend): support container runtime paths

backend/test/pi-process-manager.test.ts

@@ -1,4 +1,4 @@
-import { test, expect } from "vitest";
+import { test, expect, vi } from "vitest";
 import { spawn } from "node:child_process";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -125,3 +125,38 @@ test("spawnFor default (new) mode sends /nuova-domanda", async () => {
   expect(child._writes.join("")).toContain("/nuova-domanda");
   mgr.teardown("sid-10");
 });
+
+test("production spawn uses explicit Pi path and passes portable data root without rewriting PATH", async () => {
+  vi.stubEnv("PATH", "/usr/local/bin:/usr/bin");
+  vi.stubEnv("PI_PROVIDER_API_KEY", "provider-secret");
+  vi.stubEnv("NODE_EXTRA_CA_CERTS", "/certs/company-ca.pem");
+  const calls: any[][] = [];
+  const child = recordingChild();
+  child.stderr.resume = () => {};
+  const spawnFn = (...args: any[]) => { calls.push(args); return child as any; };
+  const cfg = loadConfig({
+    THT_HARNESS_DIR: "/app/harness",
+    PI_BIN: "/usr/local/bin/pi",
+    THT_DATA_ROOT: "/data",
+  });
+  const mgr = new PiProcessManager(cfg, { spawnFn });
+
+  try {
+    await mgr.spawnFor("portable-session", { author: "user@example.test" });
+    const [bin, args, options] = calls[0];
+    expect(bin).toBe("/usr/local/bin/pi");
+    expect(args).toEqual(["--mode", "rpc"]);
+    expect(options.cwd).toBe("/app/harness");
+    expect(options.env).toMatchObject({
+      PATH: "/usr/local/bin:/usr/bin",
+      PI_PROVIDER_API_KEY: "provider-secret",
+      NODE_EXTRA_CA_CERTS: "/certs/company-ca.pem",
+      THT_DATA_ROOT: "/data",
+      THT_SESSION: "portable-session",
+      THT_AUTHOR: "user@example.test",
+    });
+  } finally {
+    mgr.teardown("portable-session");
+    vi.unstubAllEnvs();
+  }
+});