feat(pi-permission-system): AutoReview 改为跟随主模型的对话式工具调用审查

AutoReview：

- 审查器回到 Codex Guardian 风格的对话式审查，默认跟随会话当前主模型
  （每次审查实时读取 ctx.model）；provider/model 必须同时设置才固定审查
  模型，只设其一视为配置错误并转人工。
- 结论只通过 approve / reject 两个工具给出，参数仅 reason；不强制
  toolChoice，正文文本（即使是合法 JSON）一律忽略。
- approve 自动放行；reject 转人工并在弹窗显示理由（标注模型生成）。
  超时、Provider 错误、截断、未调用工具、多次调用、参数无效等异常同样
  转人工，并附固定的系统说明；用户按 Esc 中止时直接拒绝。
- 模型调用改为 modelRegistry.streamSimple(...).result()：Pi 1.3.0 面向
  扩展的 ModelRegistry 没有 completeSimple，原写法在真实环境中每次都会
  转人工。
- 对话记录保留可信度标注；工具结果在有更短的 pi-compaction 摘要时替换
  为摘要；token 估算改为非 ASCII 字符按 1 token 计；预算可配置。
- 同一条用户消息内完全相同的请求只缓存 approve 结论。
- 默认 reasoning low、总超时 30 秒、最多 2 次尝试、maxOutputTokens 4000。

删除：

- 未发布过的 TypeSafe Jev 分类器实现、DenialCircuitBreaker。
- 整个 annotator 机制（model-explanation、注册表、registerAnnotator、
  provider-timeout）；annotators 配置键保留为已弃用并忽略，避免旧配置
  被拒绝。

测试：

- 新增 reviewer / transcript / 弹窗说明 / 默认配置测试；清理重复、恒真
  或只测实现细节的旧测试。
- 使用 deepseek-v4.1-flash 实测 5 个场景各 5 次，25 次结论全部符合预期。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/authority/permission-forwarding.test.ts

@@ -5,8 +5,6 @@ import {
   createPermissionForwardingLocation,
   isForwardedPermissionRequestForSession,
   resolvePermissionForwardingTarget,
-  SUBAGENT_PARENT_SESSION_ENV_CANDIDATES,
-  SUBAGENT_PARENT_SESSION_ENV_KEY,
 } from "#src/authority/permission-forwarding";
 import { makeSubagentRegistry } from "#test/helpers/forwarding-fixtures";
 
@@ -14,28 +12,6 @@ afterEach(() => {
   vi.unstubAllEnvs();
 });
 
-describe("SUBAGENT_PARENT_SESSION_ENV_CANDIDATES", () => {
-  test("is an array containing PI_AGENT_ROUTER_PARENT_SESSION_ID", () => {
-    expect(Array.isArray(SUBAGENT_PARENT_SESSION_ENV_CANDIDATES)).toBe(true);
-    expect(SUBAGENT_PARENT_SESSION_ENV_CANDIDATES).toContain(
-      "PI_AGENT_ROUTER_PARENT_SESSION_ID",
-    );
-  });
-
-  test("contains PI_SUBAGENT_PARENT_SESSION for CLI-based subagent extensions", () => {
-    expect(SUBAGENT_PARENT_SESSION_ENV_CANDIDATES).toContain(
-      "PI_SUBAGENT_PARENT_SESSION",
-    );
-  });
-
-  test("deprecated SUBAGENT_PARENT_SESSION_ENV_KEY equals the first candidate", () => {
-    // eslint-disable-next-line @typescript-eslint/no-deprecated -- test verifying the deprecated alias
-    expect(SUBAGENT_PARENT_SESSION_ENV_KEY).toBe(
-      SUBAGENT_PARENT_SESSION_ENV_CANDIDATES[0],
-    );
-  });
-});
-
 describe("resolvePermissionForwardingTarget", () => {
   test("hasUI=true returns the current session ID as its own target", () => {
     expect(
@@ -245,30 +221,6 @@ describe("resolvePermissionForwardingTarget — registry resolution", () => {
 // Moved from permission-system.test.ts catch-all (#342)
 // ---------------------------------------------------------------------------
 
-test("Permission forwarding resolves the parent interactive session from subagent runtime env", () => {
-  const target = resolvePermissionForwardingTarget({
-    hasUI: false,
-    isSubagent: true,
-    currentSessionId: "child-session",
-    env: {
-      PI_AGENT_ROUTER_PARENT_SESSION_ID: "parent-session",
-    },
-  });
-
-  expect(target).toEqual({ sessionId: "parent-session", source: "env" });
-});
-
-test("Permission forwarding does not guess a target session when subagent runtime env is missing", () => {
-  const target = resolvePermissionForwardingTarget({
-    hasUI: false,
-    isSubagent: true,
-    currentSessionId: "child-session",
-    env: {},
-  });
-
-  expect(target).toBe(null);
-});
-
 test("Permission forwarding uses session-scoped directories per interactive session", () => {
   const forwardingRoot = join(tmpdir(), "pi-permission-system-forwarding-root");
   const sessionA = createPermissionForwardingLocation(