feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/config-pipeline.test.ts

@@ -1,6 +1,6 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 
 import { loadAndMergeConfigs } from "#src/config-loader";
@@ -20,15 +20,12 @@ import {
  */
 describe("config pipeline seam", () => {
   let tempDir: string;
-  let agentDir: string;
-  let cwd: string;
-  let extensionRoot: string;
+  let globalConfigPath: string;
 
   beforeEach(() => {
     tempDir = mkdtempSync(join(tmpdir(), "config-pipeline-test-"));
-    agentDir = join(tempDir, "agent");
-    cwd = join(tempDir, "project");
-    extensionRoot = join(tempDir, "ext");
+    // Tests inject a temp policy path; the bundle config/ file is never touched.
+    globalConfigPath = join(tempDir, "config", "pi-permission-policy.jsonc");
   });
 
   afterEach(() => {
@@ -36,15 +33,14 @@ describe("config pipeline seam", () => {
   });
 
   function writeGlobal(content: Record<string, unknown>): void {
-    const dir = join(agentDir, "my-pi", "permission-system");
-    mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, "policy.jsonc"), JSON.stringify(content));
+    mkdirSync(dirname(globalConfigPath), { recursive: true });
+    writeFileSync(globalConfigPath, JSON.stringify(content));
   }
 
   it("a runtime knob survives the full pipeline", () => {
     writeGlobal({ debugLog: true });
 
-    const mergeResult = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const mergeResult = loadAndMergeConfigs(globalConfigPath);
     const config = normalizePermissionSystemConfig(mergeResult.merged);
 
     expect(config.debugLog).toBe(true);
@@ -56,7 +52,7 @@ describe("config pipeline seam", () => {
   it("a deprecated preview cap reaches the merge intermediate but not the runtime config", () => {
     writeGlobal({ toolInputPreviewMaxLength: 1000 });
 
-    const mergeResult = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const mergeResult = loadAndMergeConfigs(globalConfigPath);
     const config = normalizePermissionSystemConfig(mergeResult.merged);
 
     expect(mergeResult.merged.toolInputPreviewMaxLength).toBe(1000);
@@ -66,7 +62,7 @@ describe("config pipeline seam", () => {
   it("dialog budget fields survive the full pipeline and resolve to a render budget", () => {
     writeGlobal({ promptMaxRows: 12, promptFieldMaxWidth: 80 });
 
-    const mergeResult = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const mergeResult = loadAndMergeConfigs(globalConfigPath);
     const config = normalizePermissionSystemConfig(mergeResult.merged);
 
     expect(config.promptMaxRows).toBe(12);
@@ -78,7 +74,7 @@ describe("config pipeline seam", () => {
   });
 
   it("falls back to the default render budget when the config names neither field", () => {
-    const mergeResult = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const mergeResult = loadAndMergeConfigs(globalConfigPath);
     const config = normalizePermissionSystemConfig(mergeResult.merged);
 
     expect(resolveRenderBudget(config)).toEqual(DEFAULT_RENDER_BUDGET);
@@ -87,7 +83,7 @@ describe("config pipeline seam", () => {
   it("a deprecated text-summary cap likewise stops at the merge intermediate", () => {
     writeGlobal({ toolTextSummaryMaxLength: 250 });
 
-    const mergeResult = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    const mergeResult = loadAndMergeConfigs(globalConfigPath);
     const config = normalizePermissionSystemConfig(mergeResult.merged);
 
     expect(mergeResult.merged.toolTextSummaryMaxLength).toBe(250);
@@ -96,8 +92,8 @@ describe("config pipeline seam", () => {
 
 
   it("defaults apply when config file is absent", () => {
-    // No config files written — agentDir and cwd directories don't exist.
-    const mergeResult = loadAndMergeConfigs(agentDir, cwd, extensionRoot);
+    // No config file written — the injected path does not exist.
+    const mergeResult = loadAndMergeConfigs(globalConfigPath);
     const config = normalizePermissionSystemConfig(mergeResult.merged);
 
     expect(config.debugLog).toBe(false);