feat(paseo): install the gh CLI

Debian does not package gh, so use GitHub's signed apt repo. Config
lands in /home/paseo/.config/gh, inside the paseo-home volume, so the
login survives a redeploy.

paseo/Dockerfile

@@ -11,3 +11,14 @@
 FROM ghcr.io/getpaseo/paseo:latest
 
 RUN npm install -g @anthropic-ai/claude-code
+
+# gh is not in the Debian repos, so pull it from GitHub's own signed one.
+RUN install -d -m 0755 /etc/apt/keyrings \
+ && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+      -o /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+ && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+ && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
+      > /etc/apt/sources.list.d/github-cli.list \
+ && apt-get update \
+ && apt-get install -y --no-install-recommends gh \
+ && rm -rf /var/lib/apt/lists/*

paseo/README.md

@@ -1,8 +1,8 @@
 # paseo
 
 [Paseo](https://paseo.sh) — self-hosted daemon and web UI for running coding
-agents. Built from a local `Dockerfile` that adds Claude Code to the
-[official image](https://paseo.sh/docs/docker), which ships no agent CLIs.
+agents. Built from a local `Dockerfile` that adds Claude Code and `gh` to the
+[official image](https://paseo.sh/docs/docker), which ships neither.
 
 ## Setup
 
@@ -15,6 +15,7 @@ agents. Built from a local `Dockerfile` that adds Claude Code to the
    ```
 
    Then the `PASEO_PASSWORD` value.
+4. In a terminal inside Paseo, log in once: `claude` and `gh auth login`.
 
 The port is required — the UI rejects a bare hostname. You must type the
 address yourself: the daemon builds its auto-connect hint from the `Host`
@@ -54,12 +55,13 @@ Listens on `6767`, published nowhere — the platform maps the domain to it, so
 | `paseo-home` | `/home/paseo` | Daemon state, agent configs, credentials (`.claude`, `.codex`) |
 | `paseo-workspace` | `/workspace` | Code the agents work on |
 
-Claude Code's config lives in `/home/paseo/.claude`, so logins survive a
-redeploy.
+Claude Code and `gh` keep their config in `/home/paseo`, so both logins survive
+a redeploy.
 
 ## Image
 
-Add other providers to the `npm install` line in the `Dockerfile`:
+Claude Code comes from npm; `gh` from GitHub's signed apt repo, since Debian
+does not package it. Add other agent providers to the `npm install` line:
 
 ```dockerfile
 RUN npm install -g @anthropic-ai/claude-code @openai/codex opencode-ai