Seed writable Pi runtime config in Docker

docker-entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+# The mounted Pi configuration contains credentials and must stay read-only. Pi's auth storage
+# takes a lock beside auth.json, so seed a writable per-container copy before the app starts.
+# That lets ModelRuntime read and refresh credentials without ever mutating the host mount.
+if [ -d /run/pi-agent-config ]; then
+	mkdir -p "$HOME/.pi/agent"
+	cp -a /run/pi-agent-config/. "$HOME/.pi/agent/"
+	chmod -R u+rwX "$HOME/.pi/agent"
+fi
+
+exec "$@"