feat(pi-permission-system): AutoReview 改为跟随主模型的对话式工具调用审查

AutoReview：

- 审查器回到 Codex Guardian 风格的对话式审查，默认跟随会话当前主模型
  （每次审查实时读取 ctx.model）；provider/model 必须同时设置才固定审查
  模型，只设其一视为配置错误并转人工。
- 结论只通过 approve / reject 两个工具给出，参数仅 reason；不强制
  toolChoice，正文文本（即使是合法 JSON）一律忽略。
- approve 自动放行；reject 转人工并在弹窗显示理由（标注模型生成）。
  超时、Provider 错误、截断、未调用工具、多次调用、参数无效等异常同样
  转人工，并附固定的系统说明；用户按 Esc 中止时直接拒绝。
- 模型调用改为 modelRegistry.streamSimple(...).result()：Pi 1.3.0 面向
  扩展的 ModelRegistry 没有 completeSimple，原写法在真实环境中每次都会
  转人工。
- 对话记录保留可信度标注；工具结果在有更短的 pi-compaction 摘要时替换
  为摘要；token 估算改为非 ASCII 字符按 1 token 计；预算可配置。
- 同一条用户消息内完全相同的请求只缓存 approve 结论。
- 默认 reasoning low、总超时 30 秒、最多 2 次尝试、maxOutputTokens 4000。

删除：

- 未发布过的 TypeSafe Jev 分类器实现、DenialCircuitBreaker。
- 整个 annotator 机制（model-explanation、注册表、registerAnnotator、
  provider-timeout）；annotators 配置键保留为已弃用并忽略，避免旧配置
  被拒绝。

测试：

- 新增 reviewer / transcript / 弹窗说明 / 默认配置测试；清理重复、恒真
  或只测实现细节的旧测试。
- 使用 deepseek-v4.1-flash 实测 5 个场景各 5 次，25 次结论全部符合预期。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/access-intent/bash/nested-execution.test.ts

@@ -25,13 +25,6 @@ async function visitContexts(
 }
 
 describe("NESTED_EXECUTION_CONTEXTS", () => {
-  it("maps the substitution node types to their execution context", () => {
-    expect([...NESTED_EXECUTION_CONTEXTS]).toEqual([
-      ["command_substitution", "command_substitution"],
-      ["process_substitution", "process_substitution"],
-    ]);
-  });
-
   it("omits subshell, which the command enumerator emits whole", () => {
     expect(NESTED_EXECUTION_CONTEXTS.has("subshell")).toBe(false);
   });

pi-permission-system/test/access-intent/bash/node-text.test.ts

@@ -7,12 +7,6 @@ import {
 import { makeTSNode } from "#test/helpers/fake-ts-node";
 
 describe("SKIP_SUBTREE_TYPES", () => {
-  it("contains the three node types that must not be descended", () => {
-    expect(SKIP_SUBTREE_TYPES.has("heredoc_body")).toBe(true);
-    expect(SKIP_SUBTREE_TYPES.has("heredoc_end")).toBe(true);
-    expect(SKIP_SUBTREE_TYPES.has("comment")).toBe(true);
-  });
-
   it("does not contain common argument node types", () => {
     expect(SKIP_SUBTREE_TYPES.has("word")).toBe(false);
     expect(SKIP_SUBTREE_TYPES.has("string")).toBe(false);

pi-permission-system/test/access-intent/bash/token-classification.test.ts

@@ -49,15 +49,6 @@ describe("classifyTokenAsPathCandidate", () => {
       expect(classifyTokenAsPathCandidate("@scope/pkg")).toBeNull();
     });
 
-    test("@/ prefix is NOT rejected (it looks like an absolute-rooted scoped path)", () => {
-      // @/ passes the @ guard; then for path candidate it doesn't start with /
-      // or ~/, and doesn't contain .., so it returns null anyway from the
-      // acceptance gate — but the rejection is not due to the @ guard.
-      // This test documents that @/ is not rejected by the shared rejection.
-      // The path classifier then rejects it for not matching any acceptance shape.
-      expect(classifyTokenAsPathCandidate("@/foo/bar")).toBeNull();
-    });
-
     test("regex metacharacters → null", () => {
       // REGEX_METACHAR_PATTERN: .*, .+, \|, \(, \), [...], ^/
       expect(classifyTokenAsPathCandidate("foo.*")).toBeNull();
@@ -350,50 +341,12 @@ describe("classifyTokenAsRuleCandidate", () => {
   });
 
   describe("rule-vs-path divergence", () => {
-    const dotFiles = [".env", ".gitignore", ".eslintrc"];
-    const relPaths = ["src/index.ts", "lib/utils.js", "config/settings.json"];
-
-    for (const tok of dotFiles) {
-      test(`dot-file "${tok}": rule accepts, path rejects`, () => {
+    test("dot-files and bare relative paths: rule accepts, path rejects", () => {
+      for (const tok of [".env", ".gitignore", "src/index.ts"]) {
         expect(classifyTokenAsRuleCandidate(tok, posixPathFlavor)).toBe(tok);
         expect(classifyTokenAsPathCandidate(tok)).toBeNull();
-      });
-    }
-
-    for (const tok of relPaths) {
-      test(`relative path "${tok}": rule accepts, path rejects`, () => {
-        expect(classifyTokenAsRuleCandidate(tok, posixPathFlavor)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBeNull();
-      });
-    }
-
-    const sharedAccepted = ["/etc/hosts", "~/docs", "../sibling"];
-    for (const tok of sharedAccepted) {
-      test(`"${tok}": both classifiers accept`, () => {
-        expect(classifyTokenAsRuleCandidate(tok, posixPathFlavor)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBe(tok);
-      });
-    }
-
-    const winDrivePaths = [
-      "C:/Windows/win.ini",
-      "D:\\secrets\\password.txt",
-      "c:/foo",
-    ];
-    for (const tok of winDrivePaths) {
-      test(`Windows drive path "${tok}": both classifiers accept`, () => {
-        expect(classifyTokenAsRuleCandidate(tok, posixPathFlavor)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBe(tok);
-      });
-    }
-
-    const sharedRejected = ["hello", "--flag", "FOO=/bar", "https://x.com"];
-    for (const tok of sharedRejected) {
-      test(`"${tok}": both classifiers reject`, () => {
-        expect(classifyTokenAsRuleCandidate(tok, posixPathFlavor)).toBeNull();
-        expect(classifyTokenAsPathCandidate(tok)).toBeNull();
-      });
-    }
+      }
+    });
   });
 });
 
@@ -413,10 +366,6 @@ describe("classifyBareTokenCandidate", () => {
     expect(classifyBareTokenCandidate("build")).toBe("build");
   });
 
-  test("consults no policy — identical result for every token of the same shape", () => {
-    expect(classifyBareTokenCandidate("anything")).toBe("anything");
-  });
-
   describe("shared rejection prelude", () => {
     test("flag (leading dash) → null", () => {
       expect(classifyBareTokenCandidate("-r")).toBeNull();

pi-permission-system/test/access-intent/bash/wrapper-analysis.test.ts

@@ -10,8 +10,9 @@ import {
  * separated, but a quoted span is one word carrying its quotes — tree-sitter
  * emits a `string`/`raw_string` argument as a single named child.
  *
- * `program.test.ts` pins the real node adapter end to end; this stands in for it
- * so the extraction rules can be exercised without a parse.
+ * `sync-commands.test.ts` pins the real node adapter end to end (wrapperKind
+ * and executedUnit over a warm tree-sitter parse); this stands in for it so
+ * the extraction rules can be exercised without a parse.
  */
 function words(unitText: string): CommandWord[] {
   const out: CommandWord[] = [];