fix(docker): install pnpm for DeepSeek profile

[opticon454]

What

Restore clean builds of the Docker agent base image by installing pnpm and preparing the DeepSeek Harness TUI profile with its required lifecycle-script allow-list.

This preserves Codeman's ability to auto-build codeman/agent:base and then spawn isolated case containers when the base image is not already present.

When

The failure was reproduced on 27 August 2026 against upstream master at 7dfb4acf with a no-cache, pull-enabled build:

docker build --progress=plain --no-cache --pull --file docker/agent.Dockerfile .

The build stopped while adding the DeepSeek TUI profile with exit code 127:

dsh: pnpm not found on PATH — install pnpm to manage profile plugins

Why

@deepseek-ai/dsh delegates profile dependency management to pnpm. The Dockerfile installed the dsh CLI but did not install pnpm, so dsh plugin --profile dsh-tui add ... could not complete.

Because Codeman normally auto-builds this base image on the first isolated Docker case, a clean host could not create its first isolated agent container after the image build failed.

pnpm also controls dependency lifecycle scripts through the profile workspace configuration. The DeepSeek TUI dependency tree requires the @google/genai preinstall and protobufjs postinstall scripts during profile installation.

How

• Install pnpm alongside @deepseek-ai/dsh as an image build dependency.
• Initialise the dsh-tui profile with lifecycle scripts disabled.
• Add a profile-local allowBuilds policy for @google/genai and protobufjs.
• Add @deepseek-harness-tui/dsh-tui after the policy exists, allowing only those required scripts to run.
• Retain the existing profile existence and ownership checks.

Validation

• Confirmed the original no-cache image build fails with the missing-pnpm error.
• Confirmed the fixed no-cache, pull-enabled image build completes successfully.
• Confirmed the resulting image runs as the non-root agent user and contains pnpm 11.24.0, dsh 0.1.1-rc.2, and @deepseek-harness-tui/dsh-tui 0.9.3.
• Confirmed an arbitrary runtime UID can write to the prepared Codeman home directory.
• npm run typecheck passed.
• npm run lint passed.
• npm run format:check passed.
• npm run check:frontend-syntax passed for all 34 frontend JavaScript files.
• npm test passed: 6,283 passed and 12 skipped across 318 test files.