feat: enable permission-aware subagents

extensions/subagents.ts

@@ -0,0 +1,13 @@
+import { fileURLToPath } from "node:url";
+import { createPiSubagentsExtension } from "../pi-subagents/src/index.ts";
+
+// Bundle authority: Agent frontmatter may disable optional extensions, but it
+// cannot remove the exact wrapper that deploys my-pi's permission baseline and
+// binds the maintained permission-system source.
+const BUNDLED_PERMISSION_EXTENSION = fileURLToPath(
+  new URL("./permission-system.ts", import.meta.url),
+);
+
+export default createPiSubagentsExtension({
+  mandatoryExtensionPaths: [BUNDLED_PERMISSION_EXTENSION],
+});