deploy: combined opencode image + k8s + docs

- pilot/Dockerfile: python:3.12-slim + node 20 + opencode-ai@1.3.10 +
  ripgrep + pyright/typescript-language-server/eslint (npm) + ruff (pip).
  Factory + pilot scripts baked at /app. imagePullPolicy: Never (local
  import into microk8s containerd).
- .dockerignore: lean build context.
- ~/k8s/pragent-webhook.yaml: image pragent-webhook:opencode, emptyDir work
  at /tmp/pragent-work, env (PRAGENT_ENGINE, OPENCODE_MODEL, PRAGENT_FACTORY_DIR,
  PRAGENT_OPENCODE_BIN, PRAGENT_WORK_ROOT, PRAGENT_RTK_DIR='', timeout 540),
  resources 200m/512Mi -> 1500m/2Gi. Drops the ConfigMap scripts volume.
- pilot/README-webhook.md + .opencode/README.md: opencode engine section,
  build/import/apply steps, factory guide fixes (parse_review_output, steps).

Image builds (1.62GB, smoke-tested: opencode+LSPs+factory+env all present).
Import into microk8s containerd + apply pending (ctr needs sudo).

Co-Authored-By: Claude <noreply@anthropic.com>

pilot/Dockerfile

@@ -0,0 +1,51 @@
+# pragent pilot — combined webhook + opencode review-engine image.
+#
+# One container runs the Gitea webhook server (python) and subprocess-calls the
+# opencode CLI headlessly to analyze each PR. Includes node + the LSPs / linters
+# the pragent agent's bash tool can invoke on the checked-out repo. The factory
+# (opencode.json + .opencode/ agents/skills) lives at /app and is discovered via
+# PRAGENT_FACTORY_DIR=/app.
+#
+# Build:
+#   docker build -t pragent-webhook:opencode -f pilot/Dockerfile .
+# Import into microk8s (needs sudo for containerd):
+#   docker save pragent-webhook:opencode | sudo microk8s ctr images import -
+# (or: sudo microk8s ctr images import pragent-webhook-opencode.tar)
+#
+FROM python:3.12-slim
+
+# System deps: git (archive/repo reads by the agent), ripgrep (opencode dep),
+# curl + ca-certs (archive fetch), xz-utils (node install).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git ripgrep curl ca-certificates xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# Node 20 — opencode runtime + the npm-installed LSP servers below.
+RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && rm -rf /var/lib/apt/lists/*
+
+# opencode CLI, pinned to the verified version. opencode bun-installs its
+# @opencode-ai runtime into $HOME/.config/opencode/node_modules on first run
+# (cold-start ~30-60s, once per pod lifetime; the webhook returns 202 async so
+# no Gitea delivery timeout is risked). HOME is an emptyDir at runtime.
+RUN npm install -g opencode-ai@1.3.10
+
+# LSPs + linters the pragent agent's bash tool can invoke on reviewed repos.
+# (opencode's own LSP tool is opportunistic; the real signal is the agent
+# running the repo's own tsc/ruff/eslint/go vet — these make that available.)
+RUN npm install -g pyright typescript-language-server typescript eslint \
+    && pip install --no-cache-dir ruff
+
+# pragent repo: factory (opencode.json + .opencode/) + pilot scripts.
+WORKDIR /app
+COPY . /app
+
+ENV PRAGENT_FACTORY_DIR=/app \
+    PRAGENT_OPENCODE_BIN=/usr/local/bin/opencode \
+    PRAGENT_ENGINE=opencode \
+    OPENCODE_MODEL=headroom/glm-5.2:cloud \
+    OPENCODE_EXPERIMENTAL_LSP_TOOL=true \
+    PRAGENT_RTK_DIR=""
+
+CMD ["python3", "/app/pilot/webhook_server.py"]