Add session ingestion watcher as s6 service in Kubeflow image

[geier]

Context

The Kubeflow notebook image (docker/kubeflow/Dockerfile) uses s6-overlay for process supervision, running the OpenCode API server and the UI server as managed services. The session ingestion watcher (#241) needs to run alongside these as an additional s6 service so that sessions are automatically ingested into the memory system when running in Kubeflow.

This is optional for local development (where the watcher can run manually), but required for the Kubeflow deployment to ensure automatic memory ingestion without user intervention.

Goal

Add the session ingestion watcher as an s6 supervised service in the Kubeflow Docker image, so it starts automatically alongside OpenCode and the UI server.

Requirements

s6 Service Configuration

• Create an s6 service definition for the watcher
• The watcher must start after the OpenCode API server is healthy (depends on start-server.sh completing its health check)
• Configure restart behavior (restart on crash, with backoff)
• Log output to stdout (s6 captures it)

Dockerfile Changes

• Copy watcher code into the image
• Install watcher dependencies (if any beyond Bun builtins)
• Add s6 service directory

Environment Variable Configuration

• GRAPHITI_API_URL — URL of the Graphiti server (no default — memory is opt-in)
• GRAPHITI_GROUP_ID — override group ID (default: derived from project directory)
• MEMORY_ENABLED — enable/disable the watcher (default: false, only runs if Graphiti URL is set)
• The watcher should gracefully exit if GRAPHITI_API_URL is not set (memory is opt-in)

Startup Script

• Wait for OpenCode API server to be healthy before starting the watcher
• Auto-detect the project directory from OpenCode's worktree config or $HOME
• Connect to local OpenCode API at http://127.0.0.1:4096

Files to create/modify

• docker/kubeflow/s6/services.d/memory-watcher/run — s6 service run script
• docker/kubeflow/Dockerfile — add watcher code and s6 service
• docker/kubeflow/start-memory-watcher.sh — startup script with health check wait and env validation

Reference

• Existing s6 services: docker/kubeflow/s6/services.d/opencode/run → start-server.sh
• s6-overlay docs: https://github.com/just-containers/s6-overlay
• Health check pattern: docker/kubeflow/start-server.sh waits for /health endpoint
• OpenCode API: runs on 127.0.0.1:4096 inside the container
• Watcher code: memory/watcher/ (from Build background session ingestion watcher #241)

Acceptance Criteria

• Watcher starts automatically when GRAPHITI_API_URL is set
• Watcher does NOT start when GRAPHITI_API_URL is not set (opt-in behavior)
• Watcher starts only after OpenCode API is healthy
• Watcher restarts on crash (s6 supervision)
• Watcher logs are visible in container stdout
• No impact on existing OpenCode/UI server startup when memory is disabled

[geier]

Marking as blocked for now: this depends on #241 (watcher implementation) and should follow after core watcher behavior is stable.