Allow opencode to run Docker images via a dind sidecar

opencode now drives a dedicated Docker-in-Docker container instead of the
host daemon, so it can build/run images and bring up compose stacks from
within its own container.

Notes:
- dind runs in PRIVILEGED mode, this required for a nested docker daemon.
- opencode itselfs remains unprivileged
- opencode talks to dind over TCP (DOCKER_HOST=tcp://dind:2375)
  Consequence: services started in dind are reachable at dind:<port>, not
  localhost.
- The workspace needs to be bind-mounted at the same absolute path in both containers
  so compose bind-mounts resolve inside the dind daemon.
- /var/lib/docker is persisted on a mounted volume to keep images warm across
restarts.
- uses the rpio registry mirror for quicker pulls

docker-compose.yml

@@ -1,6 +1,30 @@
 services:
   opencode:
-    image: redpencil/opencode:0.0.1
+    image: redpencil/opencode:feature-with-docker
     volumes:
       - ./data/opencode/share:/root/.local/share/opencode
       - ./config/opencode/opencode.json:/root/.config/opencode/opencode.json
+#      - ./config/opencode:/root/.config/opencode
+    depends_on:
+      dind:
+        condition: service_healthy
+    environment:
+      DOCKER_HOST: "tcp://dind:2375"
+
+  dind:
+    image: docker:29.6-dind
+    privileged: true
+    # userns mode only required if you use user namespaces
+    userns_mode: "host"
+    environment:
+      DOCKER_TLS_CERTDIR: ""
+    volumes:
+      - ./data/dind-cache:/var/lib/docker
+    command:
+      - "--registry-mirror=https://docker-registry-mirror.redpencil.io"
+    healthcheck:
+      test: ["CMD", "docker", "info"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 10s