feat: 接入 Pi 内置 codemode，并修复全面审查发现的问题

- codemode：Tool Search 常驻（alwaysEnabled）、权限 allow（嵌套调用仍逐个过权限门）、
  tools.jsonc 登记使用规则；RTK 跳过 parentToolCallId 嵌套调用，避免丢失 bash
  structuredContent；Tool Search 目录过滤 hidden / codemode（script-only）exposure；
  扩展加载测试加载 builtin:codemode 并断言其常驻激活
- 搜索 key 不再经命令行参数传递：search-auth.mjs 改为 --set-stdin（先读校验再加锁），
  configure.sh 交互输入经管道、非交互用 --<provider> -
- CodeGraph 客户端监听子进程 stdin error，避免 EPIPE 未处理导致崩溃
- 移除 PI_TOOL_SEARCH/HERMES_MEMORY/RTK_CONFIG_PATH 环境变量入口，测试改用工厂 configPath 注入
- pi-subagents 固定 vitest / coverage-istanbul 4.1.10，修复 npm ls 版本冲突
- 补 pi-web-search / pi-worktree UPSTREAM.md 与 pi-minimal-footer AGENTS.md，
  files 白名单补齐并加测试；.codegraph/.gitignore 移出跟踪
- detect_kitty 优先识别官方安装目录

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

package-lock.json

@@ -2763,31 +2763,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@vitest/coverage-istanbul": {
-      "version": "4.1.12",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-istanbul/-/coverage-istanbul-4.1.12.tgz",
-      "integrity": "sha512-f98TiCqF7IriBQEpm6usi56wyD4G1cRYabI15f3Jm7R355q9tlwqJ0j1oPf+tWZ7D0LPnCh3dU70duRt10erHg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/core": "^7.29.0",
-        "@istanbuljs/schema": "^0.1.3",
-        "@jridgewell/gen-mapping": "^0.3.13",
-        "@jridgewell/trace-mapping": "0.3.31",
-        "istanbul-lib-coverage": "^3.2.2",
-        "istanbul-lib-report": "^3.0.1",
-        "istanbul-reports": "^3.2.0",
-        "magicast": "^0.5.2",
-        "obug": "^2.1.1",
-        "tinyrainbow": "^3.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
-      },
-      "peerDependencies": {
-        "vitest": "4.1.12"
-      }
-    },
     "node_modules/@vitest/expect": {
       "version": "4.1.10",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.10.tgz",
@@ -5672,9 +5647,9 @@
         "@earendil-works/pi-coding-agent": "latest",
         "@earendil-works/pi-tui": "latest",
         "@types/node": "^25.5.0",
-        "@vitest/coverage-istanbul": "^4.1.10",
+        "@vitest/coverage-istanbul": "4.1.10",
         "typescript": "^6.0.0",
-        "vitest": "^4.0.18"
+        "vitest": "4.1.10"
       },
       "peerDependencies": {
         "@earendil-works/pi-ai": ">=0.81.0",
@@ -5703,6 +5678,31 @@
         "undici-types": ">=7.24.0 <7.24.7"
       }
     },
+    "pi-subagents/node_modules/@vitest/coverage-istanbul": {
+      "version": "4.1.10",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-istanbul/-/coverage-istanbul-4.1.10.tgz",
+      "integrity": "sha512-AyNJ5pQRFqCX7pwB9PSTmoVKPaZ4H5IEVJfJsT+q1DYkXvZMEFYgJlyk5sfStmt9rVYRyYYRRsuBeImCOc39ww==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.29.0",
+        "@istanbuljs/schema": "^0.1.3",
+        "@jridgewell/gen-mapping": "^0.3.13",
+        "@jridgewell/trace-mapping": "0.3.31",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-reports": "^3.2.0",
+        "magicast": "^0.5.2",
+        "obug": "^2.1.1",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "vitest": "4.1.10"
+      }
+    },
     "pi-subagents/node_modules/nanoid": {
       "version": "5.1.16",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-5.1.16.tgz",