feat: 组合包配置集中到 my-pi/ 目录并改为整体重建

- 组合包拥有、可随时重建的配置、日志与缓存统一放在
  <agentDir>/my-pi/：permission-system/（policy.jsonc、hard-guards.jsonc、
  logs/）、rtk-optimizer/config.json、tool-search/（config.json、
  catalog-v1.json）与 system-prompt-cover.md。hashline.json、lsp.json
  由外部扩展读取固定路径，是唯一例外。
- 新增 config/bundle-manifest.json 与 scripts/rebuild-bundle-config.mjs：
  先校验全部来源与目标，在临时目录构建完整树，再整体删除旧 my-pi/
  （符号链接只删链接）并原子替换，不备份。install.sh / update.sh 每次
  运行都调用它；扩展自身不再播种或迁移配置。
- update.sh 删除 pi update 失败后的 git clean 恢复逻辑：Pi 1.3.0 会在
  下一次 pi update 时依据中断标记自行恢复。同时删除 Tool Search
  settings.json 快照迁移与封面部署脚本。
- Tool Search 改为读取 my-pi/tool-search/config.json（源为
  config/tool-search.json，须与 BUNDLE_TOOL_SEARCH_DEFAULTS 一致），
  不再读写 settings.json 的 toolSearch 段，移除 bundleDefaultsVersion。
- 默认权限策略开启 debugLog。
- 旧位置的残留文件不迁移、不清理；AGENTS.md / README 同步新约束。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/src/config-paths.ts

@@ -2,11 +2,20 @@ import { join } from "node:path";
 
 const EXTENSION_ID = "pi-permission-system";
 
+/**
+ * Bundle-owned config tree under the agent directory: install.sh / update.sh
+ * delete and rebuild `my-pi/` wholesale on every run, so policy, hard guards,
+ * and logs all live beneath it. Files at the former
+ * `extensions/pi-permission-system/` location are ignored — never migrated.
+ */
+const BUNDLE_CONFIG_DIR = "my-pi";
+const BUNDLE_PERMISSION_DIR = "permission-system";
+
 export const DEBUG_LOG_FILENAME = `${EXTENSION_ID}-debug.jsonl`;
 export const REVIEW_LOG_FILENAME = `${EXTENSION_ID}-permission-review.jsonl`;
 
 export function getGlobalConfigDir(agentDir: string): string {
-  return join(agentDir, "extensions", EXTENSION_ID);
+  return join(agentDir, BUNDLE_CONFIG_DIR, BUNDLE_PERMISSION_DIR);
 }
 
 export function getGlobalConfigPath(agentDir: string): string {

pi-permission-system/src/config-schema.ts

@@ -262,7 +262,7 @@ export const unifiedConfigSchema = z
     description:
       "Ordinary JSONC policy combining runtime knobs, AutoReview settings, and flat permission rules for pi-permission-system.",
     markdownDescription:
-      "Global ordinary JSONC policy for [pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system).\n\nPlace at `~/.pi/agent/extensions/pi-permission-system/policy.jsonc`. Project-level policy files are not loaded. Global-only hard guards use the separate `hard-guards.jsonc` schema.",
+      "Global ordinary JSONC policy for [pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system).\n\nPlace at `~/.pi/agent/my-pi/permission-system/policy.jsonc`. Project-level policy files are not loaded. Global-only hard guards use the separate `hard-guards.jsonc` schema.",
   });
 
 /** A permission decision. */