feat: 移除 Codex Fast mode 与 AutoReview 后台分析，模型改为配置驱动

移除 pi-extension-codex-fast-mode：
- 删除整个扩展目录；同步清理根 package.json 的 files / pi.extensions /
  dependencies 条目、package-lock.json、tests/extension-load.test.ts 断言
  与文档章节。
- pi-minimal-footer 的 Fast on 渲染是该扩展的唯一消费者。扩展移除后 accent
  分支不再有生产者，collectFooterStatusItems 简化为直接返回非空状态字符串，
  去掉 FooterStatusItem 与 accent 标志，避免留下死代码。

移除 500 次裁决后的后台分析体系：
- 删除 analysis-agent.ts（192 行）与 ledger.ts（296 行），以及对应的
  auto-review-runtime / auto-review-ledger 测试。
- runtime.ts 由 177 行收敛到 85 行：安装选项缩为 { service, config }；删除
  handleAgentSettled 与 agent_settled 注册；保留 session_start / turn_start
  （denial circuit breaker 属安全语义）/ session_shutdown。
- 删除 analysis 配置键：config、extension-config、config-schema、生成的
  permissions.schema.json 与种子配置。
- 删除 reviewer 的 onDecision 回调（唯一消费者是 ledger）。
- 删除迁移机制 scripts/migrate-permission-policy.mjs、其测试与 update.sh 中
  46 行 migrate_permission_policy 接线。种子部署保持“目标缺失才写入”，已存在
  的 policy.jsonc 永不被覆盖。

AutoReview 模型改为纯配置驱动：
- 删除 DEFAULT_PROVIDER / DEFAULT_MODEL 常量与 findCodexTemplate 合成逻辑；
  model.ts 由 65 行收敛到 48 行。
- provider / model 任一缺失时返回新增失败类别 model-unconfigured 并 defer 到
  人工审批；provider 未注册或模型未发布同样 defer。
- reasoning 不再有默认常量，完全由配置决定。
- session_start 在 auto-review 已列入 authorizerChain 且 provider/model 未配齐
  时 ui.notify 提示一次，避免不使用 AutoReview 的用户被打扰。
- 种子 autoReview 只保留 enabled，provider/model/reasoning 由用户按本机实际
  可用的模型填写。

破坏性变更：analysis 键已从 strictObject schema 删除，任何仍带该键的
policy.jsonc 会使整份配置被拒（fail-closed 到全 ask）。这是刻意的变更，已由
config-loader 测试固定，防止将来无声放宽。

测试：
- 新增 auto-review-model.test.ts（7 例），覆盖此前完全缺失的模型解析：真实
  命中、未配置、provider 未知、模型未发布，以及不再合成替代模型。
- 重写 auto-review-runtime.test.ts（6 例）：authorizer 注册、未配置时提示
  一次、已配置 / disabled / 无 UI / 不在 chain 时静默。
- config-loader.test.ts 新增 2 例：带 analysis 的旧配置被拒且 fail-closed、
  autoReview 逐字段合并。
- composition-root.test.ts 的 EXPECTED_HANDLERS 移除 agent_settled。

文档：AGENTS.md、README.md、pi-permission-system 的 README / CHANGELOG /
configuration.md / architecture.md / auto-review UPSTREAM.md。

验证：pi-permission-system 的 typecheck、2577 个测试与 build 全部通过；根 50
个测试通过；schema 重新生成无漂移；新种子通过 schema 校验；5 个脚本 sh -n
通过；git diff --check 无空白问题。未安装 shellcheck；未执行真实 pi install /
update（属外部写操作）。

pi-permission-system/docs/configuration.md

@@ -64,17 +64,39 @@ There is no separate `external_directory` decision. A path outside the current w
 ```
 
 > **Note:** Trailing commas are not supported. If parsing fails, ordinary policy fails safely to `ask`.
-## Built-in AutoReview and Count-Based Analysis
+## Built-in AutoReview
 
 `autoReview.enabled` controls the built-in authorizer named `auto-review`. It only receives requests that ordinary policy resolved to `ask`; it cannot bypass a hard deny. Add `"auto-review"` to `authorizerChain` to make it the primary case-by-case authority. An `allow` or `deny` verdict is final for that request. `defer` continues to the next authorizer and ultimately the human permission dialog.
 
 The reviewer uses only trusted direct-user transcript evidence and recognized structured answers. Assistant, tool, compaction, and cancelled-answer content cannot authorize an operation. Model lookup, authentication, timeout, malformed output, or internal errors all return `defer`.
 
-`analysis.threshold` counts completed automatic verdicts, not Pi turns and not deferrals. Each `allow` or `deny` appends one sanitized record under the global extension state directory. Records contain bounded surface/pattern fingerprints and risk/authorization classifications; they omit rationale, raw payload, transcript, and credentials.
+The review model comes entirely from configuration. There is no default provider/model pair and no synthesized stand-in, so automatic review stays inactive until both `autoReview.provider` and `autoReview.model` name a model your Pi registry actually publishes:
 
-When the count since the last accepted checkpoint reaches the threshold (500 by default), the ledger marks analysis pending. At the next `agent_settled` boundary the extension starts an isolated AgentSession with no tools, extensions, skills, prompt templates, themes, or project context. Its JSON proposal is schema-validated and filtered so authorization-dependent, denied, or high-risk evidence cannot become an unconditional allow candidate.
+```jsonc
+{
+  "authorizerChain": ["auto-review"],
+  "autoReview": {
+    "enabled": true,
+    "provider": "deepseek",
+    "model": "deepseek-flash",
+    "reasoning": "off"
+  }
+}
+```
 
-A successful proposal advances the checkpoint, is retained according to `retainAnalyzedBatches`, and is delivered with `deliverAs: "followUp"` and `triggerTurn: true` to this conversation. The proposal is advisory only. Neither `policy.jsonc` nor `hard-guards.jsonc` is modified until the user explicitly chooses and confirms rules. Shutdown aborts the running worker but leaves the pending checkpoint durable for the next session.
+| Key                    | Default | Description                                                                                                                              |
+| ---------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| `autoReview.enabled`   | `true`  | Registers the `auto-review` authorizer. It decides nothing until named in `authorizerChain`.                                             |
+| `autoReview.provider`  | —       | Pi provider id of the review model. No default; when absent the reviewer defers every ask.                                               |
+| `autoReview.model`     | —       | Model id within that provider. No default; when absent the reviewer defers every ask.                                                    |
+| `autoReview.reasoning` | —       | Thinking level for a reasoning-capable review model. No default; omit to send no reasoning option.                                       |
+| `autoReview.timeoutMs` | `90000` | Total retry budget for one review call.                                                                                                  |
+| `autoReview.includeBaselinePolicy` | `true` | Include the built-in Codex Guardian–style policy text.                                                                      |
+| `autoReview.additionalPolicy` | —  | Operator policy appended to the baseline. Required when `includeBaselinePolicy` is `false`.                                              |
+
+When either `provider` or `model` is missing and `auto-review` is named in `authorizerChain`, the extension notifies once at `session_start` that automatic review cannot run and every ask will reach the human prompt. An unknown provider or an unpublished model id also defers, with the reason recorded in the permission review log.
+
+Each `allow` / `deny` is written to the permission review log; the extension keeps no aggregate history, runs no background analysis agent, and never edits either policy file.
 
 ## Runtime Knobs