[Pi 2/7] Add the pinned Pi runtime, image, manifest, and entry points

[prekshivyas]

Summary

Add the integrity-verifiable runtime artifacts and managed image that define Pi as one NemoClaw agent runtime.

Parent epic: #7923

Coordination: #7744, #7756, and #7772

Depends on the accepted product decision in #7926.

Problem Statement

Pi has no NemoClaw agent manifest, owned managed image, supported startup profile, or supported runtime entry point.

The existing contributor dependency and CI image serve different consumers. They do not define the user-facing runtime contract.

The managed-image publisher and catalog currently define the shipped cohort without Pi. A Pi image outside those contracts cannot use stock buildless onboarding or Podman.

Desired Behavior

The repository contains a Pi-specific agent directory with the selected pinned package, configuration generator, entry points, policy assets, and any reviewed CI image-build sources.

CI publishes exact Pi managed-image digests for each accepted architecture. Stock onboarding consumes those digests through the shared catalog.

The manifest must identify the runtime version, state directories, lifecycle commands, supported architectures, startup-profile contract, and validation commands.

Implementation Idea

Use the manifest-first layout:

• agents/pi/manifest.yaml
• agents/pi/start.sh
• agents/pi/generate-config.ts
• agents/pi/policy-additions.yaml
• agents/pi/Dockerfile, only when required as a reviewed CI image-build source;
• agents/pi/Dockerfile.base, only when required as a reviewed CI base-image source.

Add Pi to the shipped managed-image agent list, repository map, publication matrix, exact contract validation, and atomic all-agent cohort.

Implement the shared startup-profile and image-runtime contracts. Keep Pi-specific configuration as data consumed by those contracts.

Reuse an existing Pi package or image only when its ownership, integrity, startup-profile, and lifecycle contracts match #7926.

Constraints and Non-goals

• Do not use a mutable image tag or runtime auto-update path.
• Do not build the stock Pi image from a Dockerfile during user onboarding.
• Do not add a Pi-specific Docker or Podman adapter.
• Do not add compute-runtime orchestration under agents/pi/.
• Do not implement against the current feat(runtime): add native Podman support for all agents #7872 draft seams.
• Do not add a shared multi-agent manifest.
• Do not copy contributor-only configuration into the supported runtime without review.
• Do not expand public lifecycle commands in this issue.

Acceptance Criteria

• agents/pi/manifest.yaml defines the accepted Pi runtime contract.
• Package and managed-image identities are pinned and integrity-verifiable.
• CI builds and validates each accepted platform image.
• Stock onboarding can select the exact Pi image digest without a host Dockerfile build.
• Pi is registered in the managed-image contract and repository map.
• Pi is included in the atomic publication cohort for each accepted architecture.
• The image implements the accepted startup-profile and image-runtime contracts.
• The Pi version and selected entry points run inside the image.
• Runtime configuration is generated without an upstream provider credential.
• The manifest declares persistent and reconstructible state.
• No Pi artifact contains Docker- or Podman-specific lifecycle orchestration.
• Repository checks validate the Pi manifest, catalog entry, cohort, and artifact pins.
• Dependency and supply-chain evidence covers the shipped Pi artifacts.

Category

Feature

Checklist

• I searched existing issues and this is not a duplicate.
• I described the problem and desired behavior.