Add features & update project

AGENTS.md

@@ -23,6 +23,8 @@
   access to the host Docker socket. API-key provider jobs run through OpenCode;
   Codex ChatGPT login profiles run through the Codex CLI with an injected
   `CODEX_HOME/.codex/auth.json` inside the isolated job workspace.
+  The job image must keep Node, npm, Bun, pnpm, yarn, git, ripgrep, jq,
+  Python, OpenCode, and Codex available.
 
 ## Protected and generated files
 
@@ -55,12 +57,14 @@
 - Host-run worker dev uses `scripts/dev-agent-worker` after Infisical env
   loading. It prefers Podman, sets `SPOON_AGENT_CONTAINER_ACCESS=host_port`,
   and expects `spoon-agent-job:latest` to exist locally.
-- `bun smoke:agent-container` checks that the local job image has Node, Bun,
-  git, ripgrep, jq, Python, OpenCode, and Codex available.
+- `bun smoke:agent-container` checks that the local job image has Node, npm,
+  Bun, pnpm, yarn, git, ripgrep, jq, Python, OpenCode, and Codex available.
 - Old terminal workspaces can be deleted from `Settings -> Worker`; orphaned
   containers/workdirs are cleaned through the worker HTTP API, not from the
   browser directly.
 - CI uses Gitea-injected secrets or `CI_ENV_FILE` and must not call Infisical.
+- Gitea image builds force `SPOON_AGENT_CONTAINER_RUNTIME=docker`; keep local
+  Podman auto-detection out of CI image tagging/pushing.
 - CI must provide Convex deployment env for codegen, either
   `CONVEX_SELF_HOSTED_URL` plus `CONVEX_SELF_HOSTED_ADMIN_KEY`, or
   `CONVEX_DEPLOYMENT`.