feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

config/pi-permission-policy.jsonc

@@ -38,13 +38,31 @@
     "grep": "allow",
     "find": "allow",
     "multi_grep": "allow",
+    "ls": "allow",
     "codegraph_explore": "allow",
     "lsp_diagnostics": "allow",
+    "lsp_definition": "allow",
+    "lsp_references": "allow",
+    "lsp_hover": "allow",
+    "lsp_symbols": "allow",
     "ctx_execute": "allow",
     "ctx_execute_file": "allow",
     "ctx_batch_execute": "allow",
+    "ctx_search": "allow",
+    "ctx_index": "allow",
+    "ctx_stats": "allow",
+    "ctx_doctor": "allow",
     "tool_search": "allow",
     "ask_user_question": "allow",
+    "web_search": "allow",
+    "chrome_snapshot": "allow",
+    "chrome_find": "allow",
+    "chrome_inspect": "allow",
+    "chrome_wait_for": "allow",
+    "chrome_screenshot": "allow",
+    "chrome_list_console_messages": "allow",
+    "chrome_list_network_requests": "allow",
+    "chrome_get_network_request": "allow",
 
     // Hermes memory tools write only to the extension's own agent-directory
     // stores and never touch the workspace, so they stay allowed. memory_search
@@ -55,12 +73,18 @@
     "memory_add": "allow",
     "memory_replace": "allow",
     "memory_remove": "allow",
-    "skill_manage": "allow",
+    // Skills skill_manage writes are loaded into every future session, so
+    // their creation stays human-reviewed.
+    "skill_manage": "ask",
     // pi-compaction's evidence recovery reads only the extension's own segment
     // index and never touches the workspace. It is pinned in Tool Search's
     // alwaysEnabled set, so it must not pay an AutoReview round trip per turn.
     "context_tree_query": "allow",
 
+    // Model-chosen URLs can exfiltrate data — same reason curl/wget ask.
+    "web_fetch": "ask",
+    "ctx_fetch_and_index": "ask",
+
     "ssh_connect": "ask",
     "ssh_cd": "ask",
     "ssh_read": "ask",
@@ -91,6 +115,20 @@
       "git branch --show-current*": "allow",
       "git remote -v": "allow",
       "git remote get-url*": "allow",
+      "git blame*": "allow",
+      "git describe*": "allow",
+      "git rev-list*": "allow",
+      "git merge-base*": "allow",
+      "git ls-tree*": "allow",
+      "git cat-file*": "allow",
+      "git name-rev*": "allow",
+      "git shortlog*": "allow",
+      "git stash list*": "allow",
+      "git worktree list*": "allow",
+      "git tag -l*": "allow",
+      "git tag --list*": "allow",
+      "git config --get*": "allow",
+      "git config --list*": "allow",
       "npm install *": "ask",
       "npm add *": "ask",
       "npm uninstall *": "ask",