feat: 新增系统提示词封面，并修正工具结果投影与常驻工具

系统提示词封面（新增能力）：

- extensions/system-prompt-cover.ts：读取 ~/.pi/agent/SYSTEM_COVER.md，
  在 before_agent_start 返回 { systemPrompt }，用文本拼接替换 Pi 默认
  系统提示词的开头，同时保留 tools / rules / docs / skills /
  project_context / cwd 全部分区及其原始顺序。
- 必须走 forceSystemPrompt 投影路径。customPrompt 选项会连带抑制
  tools / rules / docs 三个分区，而回填只能追加到末尾，无法恢复原顺序；
  且 forceSystemPrompt 优先级更高，二者同时存在时 customPrompt 会被
  静默忽略，因此 handler 不得写 customPrompt。
- 分割边界要求独占一行的裸标签：<project_instructions path="..."> 嵌套在
  <project_context> 内，只有裸标签才是分区边界。
- 注册在 tool-routing 之前，否则提示词已被压平，改 systemPromptOptions
  不再影响本轮请求。
- scripts/deploy-system-prompt-cover.mjs：同目录临时文件 + rename 原子
  覆盖，不保留备份；install.sh 从脚本目录、update.sh 从升级后组合包
  定位 helper，禁止回退到可能陈旧的脚本目录。
- 封面缺失、不可读或空白时静默 no-op，Pi 行为保持不变；封面每轮重新
  读取，修改后在下一轮生效，不影响已结束的历史对话。

pi-compaction 投影修正：

- 仅在「摘要 + Source 行」严格短于原文时才替换工具结果。此前命中即
  无条件替换，小结果反而被包壳放大；未替换的结果完整保留原始 content
  parts（含非文本部分）。
- deterministic.maxStubTokens 由 256 提升到 1024。

pi-tool-search 常驻工具：

- alwaysEnabled 增加 context_tree_query：恢复被投影的工具证据不应依赖
  一次 tool_search 激活，常驻同时保持请求前缀稳定。
- BUNDLE_TOOL_SEARCH_DEFAULTS_VERSION 由 3 提升到 4；
  scripts/migrate-tool-search-settings.mjs 新增 version-3 快照常量，
  使其与 version-2 一样可被完整精确匹配并迁移。
- 权限策略为 context_tree_query 显式 allow：它只读扩展自己的 segment
  索引、不触碰工作区，常驻后不应每轮触发 AutoReview 往返。该种子仅在
  全新安装时部署，已存在的用户 policy.jsonc 不会被覆盖。

文档与测试同步：

- AGENTS.md：新增 system-prompt-cover 开发约定，修正加载顺序、
  bundleDefaultsVersion、可迁移旧快照集合与常驻工具范围的描述。
- pi-tool-search 的 README / CHANGELOG 同步 version 4 与新增常驻工具。
- tests/system-prompt-cover.test.ts：覆盖顺序保持、尾部逐字节不变、
  嵌套 project_instructions 不误判、部署幂等与覆盖、缺源时非零退出。
- 修正 pi-tool-search/test/config.test.ts 与
  tests/tool-search-settings-migration.test.ts 中写死的 version 3 与
  工具列表断言。
- update-git-clean-recovery / tool-search-settings-migration 的 mock
  组合包补拷 scripts/，与真实发布包结构一致，避免 helper 定位失败。

测试：根 61/61、pi-compaction 36/36 + tsc、pi-tool-search 16/16 + tsc、
pi-permission-system 2577/2577；sh -n 与 git diff --check 通过。

pi-tool-search/CHANGELOG.md

@@ -18,7 +18,8 @@
 - Added the authoritative `user-interaction` group for the maintained `ask_user_question` TUI tool.
 - Added authoritative `chrome-navigation`, `chrome-interaction`, and `chrome-debugging` groups for all 21 tools registered by the pinned `pi-chrome` bridge after explicit session authorization.
 - Raised the bundle defaults to five active groups and 28 dynamic tools, and pinned the high-frequency Context Mode execution trio alongside CodeGraph exploration and LSP diagnostics.
-- Pinned all six Hermes memory tools in the bundle defaults and raised `bundleDefaultsVersion` to 3. The injected memory policy expects these schemas every turn, and pinning also keeps the request prefix cache-stable instead of paying a `tool_search` round trip plus a cache invalidation. `scripts/migrate-tool-search-settings.mjs` migrates the complete version-2 snapshot while leaving customized configurations untouched.
+- Pinned all six Hermes memory tools in the bundle defaults and raised `bundleDefaultsVersion` to 3. The injected memory policy expects these schemas every turn, and pinning also keeps the request prefix cache-stable instead of paying a `tool_search` round trip plus a cache invalidation. `scripts/migrate-tool-search-settings.mjs` migrates the complete version-2 snapshot with an owner-only backup, atomic replacement, and fail-safe preservation of custom or invalid settings.
+- Pinned `context_tree_query` alongside the memory tools and raised `bundleDefaultsVersion` to 4. Recovering pruned tool evidence must not depend on a `tool_search` activation, and the added name keeps the request prefix stable. The migration helper now accepts the complete version-3 snapshot in addition to version 2.
 - Added atomic multi-group activation through `tool_search.groups`, bounded to five exact group ids and rejected without state changes when the complete workflow cannot fit.
 - Weighted exact tool names, group metadata, and common SSH/Chrome/Context aliases during query routing; weak or ambiguous matches now return candidates instead of activating arbitrarily.
 - Added `/tool-search-status` for catalog source, capacity, active-group LRU order, and latest eviction diagnostics.

pi-tool-search/README.md

@@ -90,27 +90,29 @@ Pi reads this configuration from `<agent-dir>/settings.json` (normally `~/.pi/ag
       "memory_add",
       "memory_replace",
       "memory_remove",
-      "skill_manage"
+      "skill_manage",
+      "context_tree_query"
+    ],
     ],
     "showToolSearchFooterStatus": false,
     "maxActiveGroups": 5,
     "maxToolsPerGroup": 8,
     "maxDynamicTools": 28,
     "groupOverrides": {},
-    "bundleDefaultsVersion": 3
+    "bundleDefaultsVersion": 4
   }
 }
 ```
 
 | Key | Bundle default | Description |
 |---|---|---|
-| `alwaysEnabled` | CodeGraph explore, LSP diagnostics, Context execution trio, all six Hermes memory tools | Exact names pinned alongside Pi core tools |
+| `alwaysEnabled` | CodeGraph explore, LSP diagnostics, Context execution trio, all six Hermes memory tools, `context_tree_query` | Exact names pinned alongside Pi core tools |
 | `showToolSearchFooterStatus` | `false` | Show active tool/group counts |
 | `maxActiveGroups` | `5` | Maximum simultaneously active dynamic groups |
 | `maxToolsPerGroup` | `8` | Maximum size accepted from model-generated groups |
 | `maxDynamicTools` | `28` | Hard cap across active dynamic group tools |
 | `groupOverrides` | `{}` | Exact tool lists that override checked-in, generated, or fallback assignments |
-| `bundleDefaultsVersion` | `2` on a newly created default section | Bundle provenance for controlled default migrations; ignored by runtime routing |
+| `bundleDefaultsVersion` | `4` on a newly created default section | Bundle provenance for controlled default migrations; ignored by runtime routing |
 
 Example override:
 

pi-tool-search/extensions/config.ts

@@ -26,6 +26,7 @@ export const BUNDLE_TOOL_SEARCH_DEFAULTS = {
     "memory_replace",
     "memory_remove",
     "skill_manage",
+    "context_tree_query",
   ],
   showToolSearchFooterStatus: false,
   maxActiveGroups: 5,
@@ -34,7 +35,7 @@ export const BUNDLE_TOOL_SEARCH_DEFAULTS = {
   groupOverrides: {},
 } as const;
 
-export const BUNDLE_TOOL_SEARCH_DEFAULTS_VERSION = 3;
+export const BUNDLE_TOOL_SEARCH_DEFAULTS_VERSION = 4;
 
 export interface ToolSearchConfig {
   alwaysEnabled: string[];

pi-tool-search/test/config.test.ts

@@ -30,6 +30,7 @@ test("writes bundle defaults when toolSearch is absent", async () => {
       "memory_replace",
       "memory_remove",
       "skill_manage",
+      "context_tree_query",
     ]);
     assert.deepEqual(JSON.parse(await readFile(join(agentDir, "settings.json"), "utf8")), {
       toolSearch: {
@@ -39,7 +40,7 @@ test("writes bundle defaults when toolSearch is absent", async () => {
         maxToolsPerGroup: 8,
         maxDynamicTools: 28,
         groupOverrides: {},
-        bundleDefaultsVersion: 3,
+        bundleDefaultsVersion: 4,
       },
     });
     assert.equal((await stat(join(agentDir, "settings.json"))).mode & 0o777, 0o600);