chore: Pi 开发依赖跟随最新版并去掉测试里的固定版本号

- pi-hermes-memory / pi-notify / pi-permission-system / pi-subagents 的
  @earendil-works/* devDependencies 改为 latest，pi-rtk-optimizer 放开
  peer 范围；各子包锁文件刷新到 Pi 1.3.0，测试改为验证当前宿主 API。
- 新增 scripts/update-pi-devdeps.sh，统一刷新根与子包锁文件中的 Pi 版本。
- pi-subagents 适配 Pi 1.3：mention clone 改走 systemPromptOverride、
  BOM frontmatter、e2e 读取规范化后的 system 消息与工具列表。
- 根测试不再写死 ssh2 / jiti / better-sqlite3 / context-mode 版本号，
  改为精确版本格式与锁文件一致性断言；新增 latest 约束测试。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

scripts/update-pi-devdeps.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# update-pi-devdeps.sh — refresh every package-local @earendil-works/* dev
+# dependency (pinned to "latest" in each manifest) and re-resolve the lockfiles
+# to the newest published Pi release.
+#
+# Runs `npm update` in the bundle root and in every top-level directory that has
+# its own package-lock.json and declares @earendil-works/* devDependencies.
+# Package dirs without Pi devDependencies (locks without @earendil-works
+# entries) are skipped, so the Pi host runtime never lands where it does not
+# belong.
+set -eu
+
+cd "$(dirname "$0")/.."
+ROOT=$(pwd)
+
+# prints the @earendil-works/* devDependency names declared in $1/package.json
+pi_devdeps_of() {
+	node -e '
+		const pkg = require(process.argv[1]);
+		const devDeps = pkg.devDependencies || {};
+		const names = Object.keys(devDeps).filter((n) => n.startsWith("@earendil-works/"));
+		process.stdout.write(names.join(" "));
+	' "$1/package.json"
+}
+
+update_dir() {
+	dir=$1
+	names=$(pi_devdeps_of "$dir")
+	if [ -z "$names" ]; then
+		echo "skip $dir (no @earendil-works/* devDependencies)"
+		return 0
+	fi
+	echo "==> npm update in $dir: $names"
+	# Word splitting is intended: $names is a space-separated package list.
+	# shellcheck disable=SC2086
+	(cd "$dir" && npm update $names)
+}
+
+# The root declares no devDependencies, but its lock records the linked
+# packages' @earendil-works/* devDependencies, so it is always refreshed.
+echo "==> npm update in $ROOT"
+(cd "$ROOT" && npm update @earendil-works/pi-ai @earendil-works/pi-coding-agent @earendil-works/pi-tui)
+for dir in "$ROOT"/*/; do
+	[ -f "$dir/package-lock.json" ] || continue
+	[ -f "$dir/package.json" ] || continue
+	update_dir "$dir"
+done