feat: 系统提示词改为单一入口统一管理

多个扩展各自整段改写系统提示词并按加载顺序接力，任一扩展定死提示词后
其余只能做字符串手术，且各上游的工具说明与组合包实际工具格局冲突。

- 新增 extensions/system-prompt.ts 作为唯一出口（加载列表最后），按
  config/prompt/（preamble.md、tools.jsonc、routing.jsonc、sections.jsonc）
  组合开场白、工具简介/规则与 <tool_routing> 分区；替代原封面与
  tool-routing 扩展，/dump-system-prompt 输出最终提示词。
- pi-chrome、pi-ssh、pi-hermes-memory 改为写命名分区，pi-rtk-optimizer
  改写 promptGuidelines，pi-permission-system 直接过滤结构化 skills，
  均不再返回 systemPrompt；pi-chrome 未授权时不再每轮冻结提示词。
- 新增 prompt-guard 代理加载第三方扩展（Hashline、FFF、LSP、
  context-mode）：拦截直接改写提示词并按目录覆盖工具说明；context-mode
  去掉与组合包路由冲突的锚点段，保留记忆与恢复快照。
- 消除冲突：bash 简介不再建议 grep/find；Hashline edit 不再称可用 grep
  锚点、不再介绍已关闭的 replace_text；context-mode 读写/网页路由提示。
- 守门测试：工具目录覆盖率、禁用用法检查、context-mode 上游原文锁定；
  AGENTS.md 新增「系统提示词单一所有权」。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-hermes-memory/tests/prompt-injection.test.ts

@@ -2,9 +2,11 @@
  * `before_agent_start` prompt injection (#251).
  *
  * pi 0.86+ passes a normalized *clone* of the prompt options and re-renders the
- * prompt from it, so appending the memory context through `appendSystemPrompt`
+ * prompt from it, so writing the memory context into `sections.memory_policy`
  * keeps the prompt a set of named sections for later handlers and section-aware
- * providers; returning `systemPrompt` forces the rendered text instead.
+ * providers; returning `systemPrompt` forces the rendered text instead. The
+ * bundle's single system-prompt owner (extensions/system-prompt.ts) orders the
+ * section via `config/prompt/sections.jsonc`.
  *
  * 0.80.6-0.85.x put `systemPromptOptions` on the event too, but they pass the raw
  * long-lived base options and only apply a returned `systemPrompt` — a mutation
@@ -123,31 +125,38 @@ after(async () => {
 });
 
 describe("before_agent_start prompt injection", () => {
-  it("appends through structured prompt options instead of forcing the prompt", async () => {
+  it("contributes a named section through structured prompt options instead of forcing the prompt", async () => {
     await registerWith();
     const event = { systemPrompt: "base prompt", systemPromptOptions: structuredOptions() };
 
     const result = await emit("before_agent_start", event);
 
     assert.equal(result, undefined, "structured events must not force a full prompt replacement");
-    assert.match(event.systemPromptOptions.appendSystemPrompt, /memory-policy/);
+    assert.match(event.systemPromptOptions.sections.memory_policy, /memory-policy/);
+    assert.equal(
+      event.systemPromptOptions.appendSystemPrompt,
+      "",
+      "the policy is a named section, not appended text",
+    );
   });
 
-  it("appends after an earlier handler's appendSystemPrompt", async () => {
+  it("keeps earlier sections while adding memory_policy", async () => {
     await registerWith();
     const event = {
       systemPrompt: "base prompt",
-      systemPromptOptions: structuredOptions({ appendSystemPrompt: "earlier handler text" }),
+      systemPromptOptions: structuredOptions({
+        appendSystemPrompt: "earlier handler text",
+        sections: { other_section: "earlier content" },
+      }),
     };
 
     await emit("before_agent_start", event);
 
-    const appended = event.systemPromptOptions.appendSystemPrompt;
-    assert.match(appended, /earlier handler text/);
-    assert.match(appended, /memory-policy/);
-    assert.ok(
-      appended.indexOf("earlier handler text") < appended.indexOf("memory-policy"),
-      "the policy goes after earlier contributions",
+    assert.equal(event.systemPromptOptions.sections.other_section, "earlier content");
+    assert.match(event.systemPromptOptions.sections.memory_policy, /memory-policy/);
+    assert.equal(
+      event.systemPromptOptions.appendSystemPrompt,
+      "earlier handler text",
     );
   });