Agent auth path drift: pipeline/agentd uses ~/.local/share/agent but fresh creds are in ~/.pi/agent

Root cause of recent pipeline failures was stale /home/ben/.local/share/agent/auth.json (refresh token reused) while /home/ben/.pi/agent/auth.json had newer credentials. agentd containers mount ~/.local/share/agent into /root/.local/share/agent, so pipeline runs hit OAuth login failure in headless mode until files were manually synced. Need a durable fix: unify auth source, or auto-sync ~/.pi/agent/auth.json -> ~/.local/share/agent/auth.json before runs.