release/v0.1.0 Modal image omits the documented pinned Pi CLI

Release and generic reproduction

Release: release/v0.1.0 at 9b0bc8cab2e681bbffeee385c1f80f85a47087d3.

No target-specific input is needed:

pnpm install --frozen-lockfile
pnpm --filter @ultrafuzz/modal build
node --input-type=module -e '
  import { modalSecurityToolchainCommands } from "./packages/modal/dist/index.js";
  const commands = modalSecurityToolchainCommands().join("\n");
  console.log(commands.includes("@earendil-works/pi-coding-agent@0.84.2"));
'

Observed: false. The standalone packages/modal/Dockerfile also lacks the package. In the same release, ultrafuzz init generates PiAgent, the root config contains an opt-in Pi profile, the docs pin @earendil-works/pi-coding-agent 0.84.2, and ultrafuzz doctor maps PiAgent to the pi executable. A generic external Solidity target selecting this documented agent for Modal cloud-node execution therefore reaches a worker image without its required executable.

Expected: the release-built Modal image contains the documented pinned Pi CLI so a cold cloud node can execute a selected PiAgent without runtime package installation.

Related: #663 tracks the broader image/readiness work. This issue records the concrete release/v0.1.0 cloud execution blocker and its minimal reproduction.

Start with packages/modal/Dockerfile and the modalSecurityToolchainCommands entry point, then run the supplied pnpm install, Modal build, and Node reproduction. Done means the release-built Modal image includes @earendil-works/pi-coding-agent@0.84.2 and the reproduction reports true.