feat: 组合包配置集中到 my-pi/ 目录并改为整体重建

- 组合包拥有、可随时重建的配置、日志与缓存统一放在
  <agentDir>/my-pi/：permission-system/（policy.jsonc、hard-guards.jsonc、
  logs/）、rtk-optimizer/config.json、tool-search/（config.json、
  catalog-v1.json）与 system-prompt-cover.md。hashline.json、lsp.json
  由外部扩展读取固定路径，是唯一例外。
- 新增 config/bundle-manifest.json 与 scripts/rebuild-bundle-config.mjs：
  先校验全部来源与目标，在临时目录构建完整树，再整体删除旧 my-pi/
  （符号链接只删链接）并原子替换，不备份。install.sh / update.sh 每次
  运行都调用它；扩展自身不再播种或迁移配置。
- update.sh 删除 pi update 失败后的 git clean 恢复逻辑：Pi 1.3.0 会在
  下一次 pi update 时依据中断标记自行恢复。同时删除 Tool Search
  settings.json 快照迁移与封面部署脚本。
- Tool Search 改为读取 my-pi/tool-search/config.json（源为
  config/tool-search.json，须与 BUNDLE_TOOL_SEARCH_DEFAULTS 一致），
  不再读写 settings.json 的 toolSearch 段，移除 bundleDefaultsVersion。
- 默认权限策略开启 debugLog。
- 旧位置的残留文件不迁移、不清理；AGENTS.md / README 同步新约束。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-tool-search/test/extension.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -52,17 +52,17 @@ test("loads whole groups and evicts the least-recently-used group", async () =>
   process.env.PI_CODING_AGENT_DIR = agentDir;
 
   try {
+    const configDir = join(agentDir, "my-pi", "tool-search");
+    await mkdir(configDir, { recursive: true });
     await writeFile(
-      join(agentDir, "settings.json"),
+      join(configDir, "config.json"),
       JSON.stringify({
-        toolSearch: {
-          alwaysEnabled: ["codegraph_explore", "lsp_diagnostics"],
-          showToolSearchFooterStatus: false,
-          maxActiveGroups: 2,
-          maxToolsPerGroup: 4,
-          maxDynamicTools: 8,
-          groupOverrides: {},
-        },
+        alwaysEnabled: ["codegraph_explore", "lsp_diagnostics"],
+        showToolSearchFooterStatus: false,
+        maxActiveGroups: 2,
+        maxToolsPerGroup: 4,
+        maxDynamicTools: 8,
+        groupOverrides: {},
       }),
     );
     const handlers = new Map<string, (...args: any[]) => unknown>();
@@ -229,7 +229,7 @@ test("builds and caches a validated catalog with the current model on first sear
     assert.equal(result?.details.catalogSource, "model");
     assert.deepEqual(result?.usage, usage);
     assert.match(prompts[0] ?? "", /Search the public web with filters and return sources/);
-    const cache = JSON.parse(await readFile(join(agentDir, "tool-search", "catalog-v1.json"), "utf8"));
+    const cache = JSON.parse(await readFile(join(agentDir, "my-pi", "tool-search", "catalog-v1.json"), "utf8"));
     assert.equal(cache.catalog.groups[0].id, "web-research");
   } finally {
     if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
@@ -300,7 +300,7 @@ test("uses the precomputed bundle groups without calling a model", async () => {
     assert.equal(result?.details.loadedGroup, "web-tavily");
     assert.equal(result?.details.catalogSource, "bundle");
     assert.equal(modelCalls, 0);
-    await assert.rejects(readFile(join(agentDir, "tool-search", "catalog-v1.json"), "utf8"), /ENOENT/);
+    await assert.rejects(readFile(join(agentDir, "my-pi", "tool-search", "catalog-v1.json"), "utf8"), /ENOENT/);
   } finally {
     if (previousAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
     else process.env.PI_CODING_AGENT_DIR = previousAgentDir;