Rebuild Piggy's interface, and give the demo book a business to describe

Piggy answered in raw markdown, threw away every tool result it streamed,
and fought the reader's scroll on every token. The three surfaces that
made it worth having — what it read, how it reasoned, what it cost — were
all on the wire and none of them reached the screen.

The transcript is now composed of five parts under components/piggy:
answers render through streamdown, the container sticks to the bottom
without pinning the reader there, tool steps say what they read and link
to the record, and each turn carries its model and token count. Three
lifecycle bugs went with them: Stop left a permanent spinner, a truncated
stream was indistinguishable from thinking, and a failed send destroyed
the message it failed to send.

Underneath, the inference path grew timeouts, jittered retries on 429 and
5xx, tolerance of the malformed frames a 30B model emits, and an
agent_runs row per turn so chat spend is observable. The system prompt now
states that a field ending in Cents is cents — without it nemotron renders
costPerGpuHourCents: 189 as "$189 per GPU-hour", which is a 100x error on
the most scrutinised number in the room.

The demo book was arithmetically incoherent: every deal's value
contradicted its own allocation revenue by up to 3.6x, nothing had ever
closed, no customer had any paper, and the marketplace was empty. Deal
value is now derived from the allocation, the book clears 5.3% across five
blocks with one deliberately underwater, and the renewal, compliance and
agent-provenance machinery finally has rows to act on. A --clear that
deleted every obligation, SLA term and capacity request in the database
regardless of origin is scoped to the demo's own ids.

Around that: accounts have a detail page, ⌘K searches the book, Settings
can mint the API keys it always claimed to, and deploy.sh actually ships
the agent instead of silently skipping its compose profile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/build-plan.md

@@ -33,7 +33,9 @@ green CI, 47 tables, 13 migrations.
 - MCP server (9 tools, stdio), `pig` CLI, Prime Intellect client, demo dataset
 - Slack and Buzz notification adapters behind one notifier interface
 - Growth (customer lifecycle projection) and the GTM calendar
-- Docker, Compose, Caddy, `deploy.sh` with rollback, and tag-to-ship CD
+- Docker, Compose, Caddy, `deploy.sh` with rollback, and tag-to-ship CD —
+  including Piggy, which ships and rolls back with the app when `PIGGY_ENABLED`
+  is on rather than being started by hand
 
 ---
 
@@ -136,10 +138,11 @@ queue-side agent writes only to `facts`. A write path for the chat agent needs
 the same evidence discipline plus a confirmation step, and should not be added
 casually.
 
-**7. Fill in `.env.example`.** `POSTGRES_PASSWORD` and
-`PIG_SETTINGS_ENCRYPTION_KEY` are both load-bearing and both missing from it.
-`ANTHROPIC_API_KEY` is declared in `apps/api/src/lib/config.ts` and read by
-nothing — remove it or use it.
+**7. `ANTHROPIC_API_KEY` is declared in `apps/api/src/lib/config.ts` and read by
+nothing** — remove it or use it. (`POSTGRES_PASSWORD` and
+`PIG_SETTINGS_ENCRYPTION_KEY` were missing from `.env.example`, which made the
+documented `cp .env.example .env` fail at the first compose command. Both are
+in it now, along with every Piggy key.)
 
 **8. A remote MCP transport.** The server is stdio only; there is no
 Streamable HTTP transport and no `/mcp` endpoint on the API, so every user runs
@@ -210,10 +213,12 @@ returned 200. Worth remembering it was once an issue if a 403 ever appears.
 
 ## Open questions
 
-- **Which inference host for on-prem?** Settled in shape: the model *name* is
-  admin-selectable at runtime, the *host* is `PIGGY_INFERENCE_BASE` in the
-  environment. What is untested is a customer pointing it at their own
-  OpenAI-compatible endpoint.
+- **Which inference host for on-prem?** Settled in shape: both the model and
+  the host are environment values — `PIGGY_MODEL` and `PIGGY_INFERENCE_BASE`,
+  read once at Piggy's boot. Nothing about the agent is selectable at runtime;
+  `apps/piggy` never reads `platform_settings`, so a change means editing `.env`
+  and restarting the container. What is untested is a customer pointing the base
+  at their own OpenAI-compatible endpoint.
 - **Who may import?** Currently team admins and platform admins
   (`data:import`, minimum role `admin`, all teams). Easy to loosen, unpleasant
   to tighten after the fact.