feat: 组合包配置以包内 config/ 为唯一来源，并新增受保护写入人工审批

配置统一：权限策略、硬防御、Tool Search、提示词封面以及新迁入的
RTK、pi-compaction、pi-worktree、pi-hermes-memory 配置全部由扩展
直接读取已安装组合包内的 config/，pi install / pi update 即完成部署；
删除 rebuild-bundle-config.mjs 与 bundle-manifest.json，my-pi/ 只保留
日志与缓存。update.sh 成功升级后将默认 git 来源的已安装副本
reset 回发布版本。AGENTS.md 新增「组合包配置原则」。

脚本整合：search_config.sh / ssh_config.sh 合并为 configure.sh
search|ssh；install.sh / update.sh 共享函数抽到 scripts/lib.sh，远程
安装器改为先下载到临时文件再执行，下载失败可被检测。

权限：hard-guards 新增 protectedWrites，写入 Pi 凭据/设置、已安装
组合包与扩展目录、pi-ssh 凭据库时一律人工确认（跳过 AutoReview、
yolo 与 Session grant，无 UI 时拒绝）；放行 ls、LSP 查询、ctx 只读、
web_search、Chrome 只读与 git 只读命令，skill_manage 改为 ask。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/session-start.test.ts

@@ -1,8 +1,7 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
-import { getGlobalConfigPath } from "#src/config-paths";
 import { DEFAULT_EXTENSION_CONFIG } from "#src/extension-config";
 import piPermissionSystemExtension from "#src/index";
 import type { ScopeConfig } from "#src/types";
@@ -18,22 +17,30 @@ type MockHandler = (
 describe("session_start handler consolidation", () => {
   let baseDir: string;
   let originalAgentDir: string | undefined;
+  // Policy and hard-guard files are injected through the factory options so
+  // the bundle `config/` files are never touched.
+  let policyPath: string;
+  let hardGuardsPath: string;
   beforeEach(() => {
     baseDir = mkdtempSync(join(tmpdir(), "pi-permission-session-start-"));
     originalAgentDir = process.env.PI_CODING_AGENT_DIR;
 
-    const globalConfigPath = getGlobalConfigPath(baseDir);
+    policyPath = join(baseDir, "pi-permission-policy.jsonc");
+    hardGuardsPath = join(baseDir, "pi-permission-hard-guards.jsonc");
     mkdirSync(join(baseDir, "agents"), { recursive: true });
-    mkdirSync(dirname(globalConfigPath), { recursive: true });
 
     const config: ScopeConfig = {
       permission: { "*": "ask" },
     };
     writeFileSync(
-      globalConfigPath,
+      policyPath,
       `${JSON.stringify({ ...DEFAULT_EXTENSION_CONFIG, ...config }, null, 2)}\n`,
       "utf8",
     );
+    writeFileSync(
+      hardGuardsPath,
+      JSON.stringify({ version: 1, permission: { "*": "allow" } }),
+    );
 
     process.env.PI_CODING_AGENT_DIR = baseDir;
   });
@@ -63,7 +70,10 @@ describe("session_start handler consolidation", () => {
         emit: (): void => {},
         on: (): (() => void) => () => undefined,
       },
-    } as never);
+    } as never, {
+      configPath: policyPath,
+      hardGuardConfigPath: hardGuardsPath,
+    });
 
     const sessionStartHandlers = registrations.filter(
       (r) => r.name === "session_start",
@@ -87,7 +97,10 @@ describe("session_start handler consolidation", () => {
         emit: (): void => {},
         on: (): (() => void) => () => undefined,
       },
-    } as never);
+    } as never, {
+      configPath: policyPath,
+      hardGuardConfigPath: hardGuardsPath,
+    });
 
     const sessionStartHandlers = registrations.filter(
       (r) => r.name === "session_start",