feat(pi-permission-system): AutoReview 改为跟随主模型的对话式工具调用审查

AutoReview：

- 审查器回到 Codex Guardian 风格的对话式审查，默认跟随会话当前主模型
  （每次审查实时读取 ctx.model）；provider/model 必须同时设置才固定审查
  模型，只设其一视为配置错误并转人工。
- 结论只通过 approve / reject 两个工具给出，参数仅 reason；不强制
  toolChoice，正文文本（即使是合法 JSON）一律忽略。
- approve 自动放行；reject 转人工并在弹窗显示理由（标注模型生成）。
  超时、Provider 错误、截断、未调用工具、多次调用、参数无效等异常同样
  转人工，并附固定的系统说明；用户按 Esc 中止时直接拒绝。
- 模型调用改为 modelRegistry.streamSimple(...).result()：Pi 1.3.0 面向
  扩展的 ModelRegistry 没有 completeSimple，原写法在真实环境中每次都会
  转人工。
- 对话记录保留可信度标注；工具结果在有更短的 pi-compaction 摘要时替换
  为摘要；token 估算改为非 ASCII 字符按 1 token 计；预算可配置。
- 同一条用户消息内完全相同的请求只缓存 approve 结论。
- 默认 reasoning low、总超时 30 秒、最多 2 次尝试、maxOutputTokens 4000。

删除：

- 未发布过的 TypeSafe Jev 分类器实现、DenialCircuitBreaker。
- 整个 annotator 机制（model-explanation、注册表、registerAnnotator、
  provider-timeout）；annotators 配置键保留为已弃用并忽略，避免旧配置
  被拒绝。

测试：

- 新增 reviewer / transcript / 弹窗说明 / 默认配置测试；清理重复、恒真
  或只测实现细节的旧测试。
- 使用 deepseek-v4.1-flash 实测 5 个场景各 5 次，25 次结论全部符合预期。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/seed-config.test.ts

@@ -0,0 +1,106 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+import {
+  autoReviewConfigFileSchema,
+  normalizeAutoReviewConfig,
+} from "#src/auto-review/config";
+import { unifiedConfigSchema } from "#src/config-schema";
+
+/** The bundle's authoritative policy seed, as shipped. */
+const SEED_PATH = fileURLToPath(
+  new URL("../../config/pi-permission-policy.jsonc", import.meta.url),
+);
+
+function readSeed(): Record<string, unknown> {
+  const raw = readFileSync(SEED_PATH, "utf8");
+  const stripped = raw
+    .replace(/^\s*\/\/.*$/gm, "")
+    .replace(/\/\*[\s\S]*?\*\//g, "");
+  return JSON.parse(stripped) as Record<string, unknown>;
+}
+
+describe("bundled policy seed", () => {
+  it("follows the session model: enabled, with no provider/model pair", () => {
+    const seed = readSeed();
+    const parsed = autoReviewConfigFileSchema.safeParse(seed.autoReview);
+
+    expect(parsed.success).toBe(true);
+    if (!parsed.success) throw new Error("seed autoReview block is invalid");
+    expect(parsed.data).toEqual({ enabled: true });
+  });
+
+  it("ships no overrides, so the bundle runs the code-default review knobs", () => {
+    const seed = readSeed();
+    const parsed = autoReviewConfigFileSchema.parse(seed.autoReview);
+
+    // The seed writes `enabled` only; every effective value below lives in
+    // normalizeAutoReviewConfig's defaults. If either the seed or the
+    // defaults drift, this fails.
+    const effective = normalizeAutoReviewConfig(parsed);
+    expect(effective.enabled).toBe(true);
+    expect(effective.provider).toBeUndefined();
+    expect(effective.model).toBeUndefined();
+    expect(effective.reasoning).toBe("low");
+    expect(effective.timeoutMs).toBe(30_000);
+    expect(effective.maxAttempts).toBe(2);
+    expect(effective.maxOutputTokens).toBe(4_000);
+    expect(effective.transcript).toEqual({
+      messageTokens: 10_000,
+      toolTokens: 10_000,
+      maxUntrustedEntries: 40,
+    });
+  });
+
+  it("keeps auto-review in the authorizer chain", () => {
+    const seed = readSeed();
+
+    expect(seed.authorizerChain).toEqual(["auto-review"]);
+  });
+
+  it("passes the unified schema", () => {
+    const seed = readSeed();
+
+    expect(unifiedConfigSchema.safeParse(seed).success).toBe(true);
+  });
+});
+
+describe("backward compatibility with a deployed config", () => {
+  it("still accepts the retired annotators key and ignores it", () => {
+    // The bundle never overwrites a deployed policy.jsonc, so a machine that
+    // ran the annotator era keeps `annotators` in its file. Rejecting it
+    // would fail that machine closed instead of ignoring the key.
+    const result = unifiedConfigSchema.safeParse({
+      annotators: ["model-explanation"],
+    });
+
+    expect(result.success).toBe(true);
+  });
+
+  it("still accepts a configured provider/model pair", () => {
+    const parsed = autoReviewConfigFileSchema.safeParse({
+      enabled: true,
+      provider: "openai",
+      model: "gpt-5-mini",
+      reasoning: "off",
+    });
+
+    expect(parsed.success).toBe(true);
+    const effective = normalizeAutoReviewConfig(
+      parsed.success ? parsed.data : undefined,
+    );
+    expect(effective.provider).toBe("openai");
+    expect(effective.model).toBe("gpt-5-mini");
+    expect(effective.reasoning).toBe("off");
+  });
+
+  it("applies defaults when the block is absent", () => {
+    const effective = normalizeAutoReviewConfig(undefined);
+
+    expect(effective.enabled).toBe(true);
+    expect(effective.reasoning).toBe("low");
+    expect(effective.maxAttempts).toBe(2);
+  });
+});