feat(pi-permission-system): AutoReview 改为跟随主模型的对话式工具调用审查

AutoReview：

- 审查器回到 Codex Guardian 风格的对话式审查，默认跟随会话当前主模型
  （每次审查实时读取 ctx.model）；provider/model 必须同时设置才固定审查
  模型，只设其一视为配置错误并转人工。
- 结论只通过 approve / reject 两个工具给出，参数仅 reason；不强制
  toolChoice，正文文本（即使是合法 JSON）一律忽略。
- approve 自动放行；reject 转人工并在弹窗显示理由（标注模型生成）。
  超时、Provider 错误、截断、未调用工具、多次调用、参数无效等异常同样
  转人工，并附固定的系统说明；用户按 Esc 中止时直接拒绝。
- 模型调用改为 modelRegistry.streamSimple(...).result()：Pi 1.3.0 面向
  扩展的 ModelRegistry 没有 completeSimple，原写法在真实环境中每次都会
  转人工。
- 对话记录保留可信度标注；工具结果在有更短的 pi-compaction 摘要时替换
  为摘要；token 估算改为非 ASCII 字符按 1 token 计；预算可配置。
- 同一条用户消息内完全相同的请求只缓存 approve 结论。
- 默认 reasoning low、总超时 30 秒、最多 2 次尝试、maxOutputTokens 4000。

删除：

- 未发布过的 TypeSafe Jev 分类器实现、DenialCircuitBreaker。
- 整个 annotator 机制（model-explanation、注册表、registerAnnotator、
  provider-timeout）；annotators 配置键保留为已弃用并忽略，避免旧配置
  被拒绝。

测试：

- 新增 reviewer / transcript / 弹窗说明 / 默认配置测试；清理重复、恒真
  或只测实现细节的旧测试。
- 使用 deepseek-v4.1-flash 实测 5 个场景各 5 次，25 次结论全部符合预期。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/CHANGELOG.md

@@ -9,7 +9,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Make the AutoReview model configuration-only: drop the built-in `openai-codex` / `codex-auto-review` default pair and the synthesized Codex stand-in, so automatic review runs exactly the provider/model named in `policy.jsonc` and defers to the human prompt (with a one-time startup notice) when either is unset, unknown, or unpublished.
+- **Replace the AutoReview text-JSON chat reviewer with a conversational tool-call reviewer.** The reviewer makes one independent model call per ask — a fixed review prompt, the rendered transcript, and a bounded JSON description of the planned action — and reaches its verdict only by calling one of two tools, `approve` or `reject`, each carrying a `reason`. A reply with no tool call counts as no verdict; multiple calls, unknown tools, and missing reasons count as invalid responses; neither is retried. An experimental TypeSafe Jev classifier rewrite explored in the working tree was dropped before release and never shipped.
+- **The review model follows the session by default.** With `autoReview.provider` and `autoReview.model` both unset, the reviewer calls the session's current model (`ctx.model`), resolved live per ask so a mid-session switch applies to the next request. Setting both pins a fixed reviewer; setting exactly one is a misconfiguration that warns once at `session_start` and defers every ask.
+- **A rejection defers instead of denying.** `reject` maps to `defer` and the model's `reason` is shown in the human permission prompt, labelled as model-generated. Every review failure — timeout, provider error, malformed or truncated reply, unresolved model — also defers with a fixed system-authored note. Pressing Esc during a review aborts it and denies outright, so no human dialog appears after the user already refused.
+- **Cache approvals within one user message.** An `allow` is reused for the same action while the conversation's latest trusted entry is unchanged; a new user message invalidates the cache, and rejects and failures are never cached.
+- Bound the rendered transcript with a conservative token estimator (ASCII counts a quarter token per character, every non-ASCII codepoint a full token — `length / 4` under-counts CJK by roughly 2–4x), expose the budgets under `autoReview.transcript` (`messageTokens`, `toolTokens`, `maxUntrustedEntries`), and substitute pi-compaction tool-result summaries when they are strictly shorter.
+- Make `autoReview.reasoning` effective again (default `"low"`), passed only to reasoning-capable models; add `autoReview.timeoutMs` (default `30000`, total across attempts), `autoReview.maxAttempts` (default `2`), and `autoReview.maxOutputTokens` (default `4000`).
+
+### Removed
+
+- Remove the annotator mechanism entirely: the `annotators` registry seam, `registerAnnotator` on the permissions service, the `model-explanation` annotator, and its provider-timeout resolution. The `annotators` config key is **deprecated and ignored** — still accepted so a deployed `policy.jsonc` keeps loading, but it no longer takes effect.
+- Remove the experimental classifier rewrite and its denial circuit breaker (the uncommitted `autoReview.classifier.*` options, the circuit state, and the turn-reset logic); they never reached a release.
+- Remove the text-JSON verdict path (`parseReviewAssessment` and friends): the verdict protocol is now exclusively the `approve` / `reject` tool calls, and prose responses are ignored.
+- Remove the `includeBaselinePolicy` / `additionalPolicy` prompt-composition options and `findOfType("classifier", …)` model resolution; the review model resolves through `find` for configured pairs or `ctx.model` in follow mode.
+
+### Changed (earlier)
 - Remove AutoReview's 500-verdict count ledger, isolated background analysis AgentSession, and same-session proposal delivery; the reviewer now only decides each ask and writes its verdict to the permission review log.
 - Integrate the former standalone AutoReview authorizer into the permission-system composition root; split user-editable ordinary policy and global-only hard guards into independent JSONC files.
 - Simplify ordinary policy to one global `policy.jsonc`: stop loading project policy files, rank matching patterns by specificity instead of declaration order, remove the `external_directory` gate and delegation envelope, let configured authorizers approve any ordinary-policy ask including `path`, and leave all active-tool visibility changes exclusively to Tool Search.