feat(pi-hermes-memory): 接入持久记忆扩展并移除 Hippo

用仓库内 pi-hermes-memory 替换 hippo-memory-pi，清理 Hippo 在组合包中的
全部注入点。

移除 Hippo：
- 删除 hippo-memory-pi/ 与 config/hippo-memory-version。
- extensions/plugin-init.ts 只保留 CodeGraph 初始化目标与预检。
- install.sh / update.sh / uninstall.sh 移除 Hippo CLI 的安装、升级、卸载
  与版本校验逻辑；uninstall.sh 同时删除仅服务于该提示的死代码 ask_yes_no。
- 删除 tests/hippo-extension.test.ts 与 tests/hippo-scripts.test.ts。
- tests/extension-load.test.ts 反转“不得加载 Hermes”的断言为必须加载，
  并断言其排在 pi-compaction 之前。

接入 pi-hermes-memory：
- package.json 增加 file:./pi-hermes-memory 依赖、files 条目与加载入口；
  加载顺序位于 pi-compaction 之前，否则 flushOnCompact 会被 pi-compaction
  的 { cancel: true } 静默跳过。
- 六个记忆工具在 Tool Search 中常驻：memory_search 与 session_search 连同
  context_tree_query 归入 memory-recall，memory_add / memory_replace /
  memory_remove / skill_manage 归入 memory-management。常驻是必需的——注入
  的 memory policy 会在普通工作中指示模型调用它们，schema 不可见会让模型
  静默放弃而不是去 tool_search，同时常驻也保持请求前缀缓存稳定。
- bundleDefaultsVersion 由 2 升到 3；migrate-tool-search-settings.mjs 新增
  上一版快照到当前版本的迁移路径，仍只迁移完整匹配的默认快照并保留自定义
  配置。
- config/pi-permission-policy.jsonc 为六个工具设置 allow：它们只写扩展自己的
  agent 目录数据、不触碰工作区，且 memory_search 每轮都可能被调用，落入
  默认 ask 会产生每轮 AutoReview 往返。

依赖：
- pi-hermes-memory 的 devDependencies 由上游 ^0.80.2 等范围改为与根包一致的
  精确版本。上游范围与根包 0.84.2 不兼容，会让 npm 在本目录嵌套安装第二套
  Pi runtime（实测 229 MB），违反“不得在组合包内再安装一套 Pi runtime”的
  纪律。
- 根 allowScripts 保持只有 better-sqlite3@12.11.1。hermes 的
  better-sqlite3@13 运行时 dlopen 的是包内 N-API 预编译二进制
  prebuilds/<platform>.node，npm 因 binding.gyp 推断出的 node-gyp rebuild
  无需执行；实测删除 build/ 目录后仍正常工作。

文档：AGENTS.md 与 README.md 改写记忆章节，新增 pi-hermes-memory 开发约定，
替换文末的 Hippo 项目记忆块。

验证：根 12 个测试文件、pi-tool-search 的 typecheck/test/build、
pi-permission-system 的 typecheck/2569 测试、pi-hermes-memory 自带的 59 个
测试文件全部通过；隔离 Pi 环境联合加载无错误并生成 bundleDefaultsVersion 3；
npm install 幂等；迁移 helper 对 v2 快照迁移、对自定义配置保留。

tests/plugin-init.test.ts

@@ -11,12 +11,12 @@ import pluginInitExtension, {
 	validatePluginInitCwd,
 } from "../extensions/plugin-init.ts";
 
-test("initializes missing CodeGraph and Hippo state after preflighting both CLIs", async () => {
+test("initializes missing CodeGraph state after preflighting the CLI", async () => {
 	const cwd = await mkdtemp(join(tmpdir(), "my-pi-plugin-init-"));
 	const calls: Array<{ command: string; args: string[]; cwd: string }> = [];
 	try {
 		const targets = await findMissingPluginInitializers(cwd);
-		assert.deepEqual(targets.map(({ name }) => name), ["CodeGraph", "Hippo"]);
+		assert.deepEqual(targets.map(({ name }) => name), ["CodeGraph"]);
 
 		await initializeMissingPlugins(cwd, targets, async (command, args, options) => {
 			calls.push({ command, args, cwd: options.cwd });
@@ -25,30 +25,25 @@ test("initializes missing CodeGraph and Hippo state after preflighting both CLIs
 
 		assert.deepEqual(calls, [
 			{ command: "codegraph", args: ["--version"], cwd },
-			{ command: "hippo", args: ["--version"], cwd },
 			{ command: "codegraph", args: ["init", cwd], cwd },
-			{ command: "hippo", args: ["init"], cwd },
 		]);
 	} finally {
 		await rm(cwd, { recursive: true, force: true });
 	}
 });
 
-test("uses the CLIs' database files as authoritative initialization markers", async () => {
+test("uses the CLI's database file as the authoritative initialization marker", async () => {
 	const cwd = await mkdtemp(join(tmpdir(), "my-pi-plugin-init-"));
 	const calls: string[] = [];
 	try {
 		await mkdir(join(cwd, ".codegraph"));
-		await mkdir(join(cwd, ".hippo"));
 		assert.deepEqual(
 			(await findMissingPluginInitializers(cwd)).map(({ name }) => name),
-			["CodeGraph", "Hippo"],
-			"bare state directories must not count as initialized",
+			["CodeGraph"],
+			"a bare state directory must not count as initialized",
 		);
 
 		await writeFile(join(cwd, ".codegraph", "codegraph.db"), "");
-		assert.deepEqual((await findMissingPluginInitializers(cwd)).map(({ name }) => name), ["Hippo"]);
-		await writeFile(join(cwd, ".hippo", "hippo.db"), "");
 		const targets = await findMissingPluginInitializers(cwd);
 		assert.deepEqual(targets, []);
 
@@ -56,7 +51,7 @@ test("uses the CLIs' database files as authoritative initialization markers", as
 			calls.push(`${command} ${args.join(" ")}`);
 			return { code: 0, stdout: "ok", stderr: "" };
 		});
-		assert.deepEqual(calls, ["codegraph --version", "hippo --version"]);
+		assert.deepEqual(calls, ["codegraph --version"]);
 	} finally {
 		await rm(cwd, { recursive: true, force: true });
 	}
@@ -67,7 +62,7 @@ test("rejects unsafe project roots", () => {
 	assert.throws(() => validatePluginInitCwd(homedir()), /用户主目录/);
 });
 
-test("preflights both CLIs before creating project state", async () => {
+test("preflights the CLI before creating project state", async () => {
 	const cwd = await mkdtemp(join(tmpdir(), "my-pi-plugin-init-"));
 	const calls: string[] = [];
 	try {
@@ -75,13 +70,11 @@ test("preflights both CLIs before creating project state", async () => {
 		await assert.rejects(
 			initializeMissingPlugins(cwd, targets, async (command, args) => {
 				calls.push(`${command} ${args.join(" ")}`);
-				return command === "hippo"
-					? { code: 1, stdout: "", stderr: "not installed" }
-					: { code: 0, stdout: "ok", stderr: "" };
+				return { code: 1, stdout: "", stderr: "not installed" };
 			}),
-			/Hippo 检测失败：not installed/,
+			/CodeGraph 检测失败：not installed/,
 		);
-		assert.deepEqual(calls, ["codegraph --version", "hippo --version"]);
+		assert.deepEqual(calls, ["codegraph --version"]);
 	} finally {
 		await rm(cwd, { recursive: true, force: true });
 	}
@@ -125,9 +118,7 @@ test("plugin_init confirms the target and hot-reloads after initialization", asy
 		assert.match(confirmation, new RegExp(cwd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")));
 		assert.deepEqual(calls, [
 			"codegraph --version",
-			"hippo --version",
 			`codegraph init ${cwd}`,
-			"hippo init",
 		]);
 		assert.equal(reloaded, true);
 	} finally {
@@ -135,14 +126,14 @@ test("plugin_init confirms the target and hot-reloads after initialization", asy
 	}
 });
 
-test("plugin_init reports retained partial state and does not reload when a later initializer fails", async () => {
+test("plugin_init reports the failure and does not reload when initialization fails", async () => {
 	let command: { handler: (args: string, ctx: any) => Promise<void> } | undefined;
 	const pi = {
 		registerCommand(_name: string, definition: typeof command) {
 			command = definition;
 		},
 		exec: async (program: string, args: string[]) => ({
-			code: program === "hippo" && args[0] === "init" ? 1 : 0,
+			code: program === "codegraph" && args[0] === "init" ? 1 : 0,
 			stdout: "",
 			stderr: "mock failure",
 		}),
@@ -168,8 +159,7 @@ test("plugin_init reports retained partial state and does not reload when a late
 				reloaded = true;
 			},
 		});
-		assert.match(error, /Hippo 初始化失败：mock failure/);
-		assert.match(error, /已完成的 CodeGraph 初始化会保留，不会自动回滚/);
+		assert.match(error, /CodeGraph 初始化失败：mock failure/);
 		assert.equal(reloaded, false);
 	} finally {
 		await rm(cwd, { recursive: true, force: true });