refactor(agent-pod): merge hub into pi container, drop kubectl-exec spawn step

agent-console complained about the two-step workflow: kubectl exec a
script to spawn an agent, separate terminal to watch it. Root cause
was hub being a separate Go sidecar with no access to the pi binary
or its config, so it could only watch, never trigger.

hub.js now runs inside the pi container itself (same filesystem, same
PATH) and exposes POST /run, which spawns `pi -p --mode json` directly
and streams it over the same /console WebSocket everyone else is
already watching. agent-console gained a `run <agent> <prompt>`
subcommand that POSTs then watches -- no separate exec step, no
separate terminal. Drops the golang:1.25-alpine sidecar container and
agent-run-configmap.yaml entirely (both superseded).

ConfigMaps regenerated via local-harness/hub/sync-to-homelab.sh
instead of hand-copied, so hub.js/config.json/settings.json each have
exactly one source of truth.

k8s/apps/agent-pod/deployment.yaml

@@ -22,12 +22,19 @@ spec:
           hostnames:
             - "api.riotpiao.com"
       containers:
+        # hub.js runs in the same container as pi (not a sidecar) so it can
+        # spawn `pi -p --mode json` directly via child_process -- a separate
+        # container can't exec into another container's filesystem/PATH.
+        # It IS the container's long-running process now; no more `sleep
+        # infinity` placeholder.
         - name: pi
           image: node:22-slim
           command:
             - sh
             - -c
-            - "npm install -g @earendil-works/[email protected] && sleep infinity"
+            - "npm install -g @earendil-works/[email protected] && npm install --prefix /root ws && node /root/hub.js"
+          ports:
+            - containerPort: 9090
           resources:
             requests:
               cpu: "2"
@@ -45,34 +52,9 @@ spec:
             - name: pi-models
               mountPath: /root/.pi/agent/models.json
               subPath: models.json
-            - name: agent-run-script
-              mountPath: /root/agent-run.js
-              subPath: agent-run.js
-        # Sidecar: relays pi's --mode json session events to agent-console.
-        # Runs via `go run` on mounted source rather than a prebuilt image --
-        # same "no registry yet" tradeoff as the pi container's npm install.
-        - name: hub
-          image: golang:1.25-alpine
-          workingDir: /hub
-          command:
-            - sh
-            - -c
-            - "go run ."
-          env:
-            - name: HUB_ADDR
-              value: ":9090"
-          ports:
-            - containerPort: 9090
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-          volumeMounts:
             - name: hub-src
-              mountPath: /hub
+              mountPath: /root/hub.js
+              subPath: hub.js
       volumes:
         - name: pi-config
           configMap:
@@ -80,9 +62,6 @@ spec:
         - name: pi-models
           secret:
             secretName: pi-models
-        - name: agent-run-script
-          configMap:
-            name: agent-run-script
         - name: hub-src
           configMap:
             name: hub-src