feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/authority/permission-dialog.test.ts

@@ -178,6 +178,37 @@ describe("requestPermissionDecisionFromUi", () => {
     expect(options[1]).toBe("Yes, for this session");
   });
 
+  describe("hideSessionOption (human-only asks)", () => {
+    it("omits the session option when hideSessionOption is set", async () => {
+      const selectFn = vi.fn().mockResolvedValue("Yes");
+      const ui: PermissionDecisionUi = { select: selectFn, input: vi.fn() };
+      await requestPermissionDecisionFromUi(ui, "Title", "Message", {
+        hideSessionOption: true,
+      });
+      const options = selectFn.mock.calls[0][1] as string[];
+      expect(options).toEqual(["Yes", "No", "No, provide reason"]);
+    });
+
+    it("does not open the scope select when the session option is hidden", async () => {
+      const selectFn = vi.fn().mockResolvedValue("Yes");
+      const ui: PermissionDecisionUi = { select: selectFn, input: vi.fn() };
+      const result = await requestPermissionDecisionFromUi(
+        ui,
+        "Title",
+        "Message",
+        {
+          hideSessionOption: true,
+          sessionScope: {
+            subagentLabel: "This subagent only",
+            servingSessionLabel: "The whole session",
+          },
+        },
+      );
+      expect(selectFn).toHaveBeenCalledTimes(1);
+      expect(result).toEqual({ approved: true, state: "approved" });
+    });
+  });
+
   describe("sessionScope two-step (forwarded asks)", () => {
     const sessionScope = {
       subagentLabel: "This subagent only",