fix(agents): bundle workspace deps into flue runtime

Replace @code/env and @code/primitives imports with local modules so
the Node deploy artifact does not resolve workspace packages to
TypeScript source at runtime. Switch Docker build to pnpm frozen
install, add runner Dockerfile and a liveness health endpoint.

packages/agents/src/app.ts

@@ -1,16 +1,16 @@
-import { parseAgentEnv } from "@code/env/agent";
-import { WorkAttemptExecutionError } from "@code/primitives/execution-runtime";
 import { registerProvider } from "@flue/runtime";
 import type { Fetchable } from "@flue/runtime/routing";
 import { flue } from "@flue/runtime/routing";
 import { Hono } from "hono";
 
 import { internalRoute } from "./auth/internal-route";
+import { parseAgentEnv } from "./runtime/agent-env";
 import { runtimeRegistry } from "./runtime/agent-os-registry";
 import {
   cancelAgentOsAttempt,
   executeAgentOsAttempt,
 } from "./runtime/attempt-runner";
+import { WorkAttemptExecutionError } from "./runtime/zopu-primitives";
 
 const agentEnv = parseAgentEnv(process.env);
 
@@ -35,6 +35,11 @@ registerProvider(agentEnv.AGENT_MODEL_PROVIDER, {
 
 const app = new Hono();
 
+// Unauthenticated liveness probe used by the VDS Compose healthcheck and CI
+// staging verification. It must not depend on Convex, Rivet, or the model
+// provider; it only confirms the Flue Node process is accepting requests.
+app.get("/health", (context) => context.json({ status: "ok" }));
+
 app.post("/internal/work-attempts/execute", internalRoute, async (context) => {
   try {
     return context.json(await executeAgentOsAttempt(await context.req.json()));

packages/agents/src/runtime/agent-env.ts

@@ -0,0 +1 @@
+export { parseAgentEnv } from "../../../env/src/agent";

packages/agents/src/runtime/agent-os-registry.ts

@@ -1,6 +1,7 @@
-import { makePiAgentOsConfig } from "@code/primitives";
 import { agentOS, setup } from "@rivet-dev/agentos";
 
+import { makePiAgentOsConfig } from "./zopu-primitives";
+
 const MAX_ACP_COMPLETED_MESSAGE_BYTES = 128 * 1024 * 1024;
 const piConfig = makePiAgentOsConfig();
 

packages/agents/src/runtime/attempt-runner.ts

@@ -1,20 +1,20 @@
-import { parseAgentEnv } from "@code/env/agent";
-import {
-  decodeWorkAttemptExecutionInput,
-  makePiHomeFiles,
-  piSessionEnv,
-} from "@code/primitives";
-import type {
-  ExecutionEvent,
-  WorkAttemptExecutionResult,
-} from "@code/primitives";
 import { createHostDirBackend } from "@rivet-dev/agentos-core";
 import { createClient } from "@rivet-dev/agentos/client";
 import { Effect } from "effect";
 
+import { parseAgentEnv } from "./agent-env";
 import type { runtimeRegistry } from "./agent-os-registry";
 import { classifyRuntimeFailure, executionError } from "./execution-errors";
 import { RepositoryWorkspace } from "./repository-workspace";
+import {
+  decodeWorkAttemptExecutionInput,
+  makePiHomeFiles,
+  piSessionEnv,
+} from "./zopu-primitives";
+import type {
+  ExecutionEvent,
+  WorkAttemptExecutionResult,
+} from "./zopu-primitives";
 
 const event = (
   sequence: number,

packages/agents/src/runtime/execution-errors.ts

@@ -1,4 +1,4 @@
-import { WorkAttemptExecutionError } from "@code/primitives/execution-runtime";
+import { WorkAttemptExecutionError } from "./zopu-primitives";
 
 export const executionError = (
   message: string,

packages/agents/src/runtime/repository-workspace.ts

@@ -11,7 +11,7 @@ import {
 } from "node:fs/promises";
 import path from "node:path";
 
-import type { PiHomeFiles } from "@code/primitives";
+import type { PiHomeFiles } from "./zopu-primitives";
 
 interface PrepareRepositoryInput {
   attemptId: string;

packages/agents/src/runtime/zopu-primitives.ts

@@ -0,0 +1,14 @@
+export {
+  decodeWorkAttemptExecutionInput,
+  WorkAttemptExecutionError,
+} from "../../../primitives/src/execution-runtime";
+export type {
+  ExecutionEvent,
+  WorkAttemptExecutionResult,
+} from "../../../primitives/src/execution-runtime";
+export {
+  makePiAgentOsConfig,
+  makePiHomeFiles,
+  piSessionEnv,
+} from "../../../primitives/src/agent-os";
+export type { PiHomeFiles } from "../../../primitives/src/agent-os";