feat(paseo): install the agent CLIs named in AGENT_CLIS on start

The entrypoint runs each vendor's installer through gosu paseo for every name
in AGENT_CLIS whose command is not already on PATH, so a fresh paseo-home
volume comes up with agents ready. Defaults to claude and codex; the other
four are opt-in.

On start rather than in the Dockerfile: Docker seeds a named volume from the
image once, at creation, so a build-time install into /home/paseo would only
ever reach a volume that did not exist yet. The check also chowns /home/paseo
first, since a freshly created volume can arrive owned by root and the base
entrypoint has not run its own chown by then.

Unknown names and failed installs are logged and skipped rather than taking
the container down with them.

entrypoint.sh loses its explanations to the README along the way.

paseo/.env.example

@@ -21,6 +21,12 @@ PASEO_TRUSTED_PROXIES=uniquelocal
 # label is a random container ID.
 PASEO_LABEL=paseo
 
+# Agent CLIs to install on start, if not already present. Space- or
+# comma-separated, from: claude codex opencode copilot omp pi. Leave empty to
+# install none. The first start with a new paseo-home volume downloads a few
+# hundred MB per agent and takes a while; later starts only check.
+AGENT_CLIS=claude codex
+
 # Timezone for logs and agent shells.
 TZ=Asia/Ho_Chi_Minh