docker: install runtime deps inside the image, expand .dockerignore

Dockerfile now runs `npm ci --omit=dev` inside /opt/pi-customizations so
v1.1's new runtime deps (linkedom + readability + turndown + turndown-plugin-gfm)
are present — they aren't part of pi's global install.

.dockerignore now excludes more host-only or test-only paths:
- .pi/, .claude/, .worktrees/ (local agent/IDE/git state)
- docs/ (planning docs, not needed in image)
- *.test.ts, **/fixtures/, vitest.config.ts (test code/data, 200 KB of fixtures)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -1,3 +1,10 @@
 node_modules/
 .git/
+.pi/
+.claude/
+.worktrees/
+docs/
 *.log
+*.test.ts
+**/fixtures/
+vitest.config.ts

Dockerfile

@@ -36,10 +36,14 @@ WORKDIR /sandbox
 
 USER sandbox
 
+# Install this package's runtime dependencies into /opt/pi-customizations/node_modules.
+# pi-provided imports (@earendil-works/*, typebox) resolve from pi's global install,
+# but the websearch extension also pulls in linkedom + readability + turndown +
+# turndown-plugin-gfm (declared in dependencies); those need to be present locally.
+RUN cd /opt/pi-customizations && npm ci --omit=dev --no-audit --no-fund
+
 # Register the customizations with pi. A local-path install is recorded in
-# ~/.pi/agent/settings.json without copying; the extensions' runtime imports
-# (@earendil-works/*, typebox) resolve from pi's global install, so the package
-# needs no node_modules of its own.
+# ~/.pi/agent/settings.json without copying.
 RUN pi install /opt/pi-customizations
 
 # Informational only — OpenShell's supervisor overrides this; launch with `-- pi`.