chore: Pi 开发依赖跟随最新版并去掉测试里的固定版本号

- pi-hermes-memory / pi-notify / pi-permission-system / pi-subagents 的
  @earendil-works/* devDependencies 改为 latest，pi-rtk-optimizer 放开
  peer 范围；各子包锁文件刷新到 Pi 1.3.0，测试改为验证当前宿主 API。
- 新增 scripts/update-pi-devdeps.sh，统一刷新根与子包锁文件中的 Pi 版本。
- pi-subagents 适配 Pi 1.3：mention clone 改走 systemPromptOverride、
  BOM frontmatter、e2e 读取规范化后的 system 消息与工具列表。
- 根测试不再写死 ssh2 / jiti / better-sqlite3 / context-mode 版本号，
  改为精确版本格式与锁文件一致性断言；新增 latest 约束测试。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/system-prompt.test.ts

@@ -551,10 +551,10 @@ test("context-mode upstream still appends the single anchor-bearing user message
 	const packageJson = JSON.parse(
 		await readFile(join(repositoryRoot, "package.json"), "utf8"),
 	) as { dependencies: Record<string, string> };
-	assert.equal(
-		packageJson.dependencies["context-mode"],
-		"1.0.169",
-		"the context-filter pin requires the exact upstream version",
+	assert.match(
+		packageJson.dependencies["context-mode"] ?? "",
+		/^\d+\.\d+\.\d+$/,
+		"the context-filter pin requires an exact upstream version",
 	);
 	const upstream = await readFile(
 		join(repositoryRoot, "node_modules/context-mode/build/adapters/pi/extension.js"),