feat: 接入 Pi 内置 codemode，并修复全面审查发现的问题

- codemode：Tool Search 常驻（alwaysEnabled）、权限 allow（嵌套调用仍逐个过权限门）、
  tools.jsonc 登记使用规则；RTK 跳过 parentToolCallId 嵌套调用，避免丢失 bash
  structuredContent；Tool Search 目录过滤 hidden / codemode（script-only）exposure；
  扩展加载测试加载 builtin:codemode 并断言其常驻激活
- 搜索 key 不再经命令行参数传递：search-auth.mjs 改为 --set-stdin（先读校验再加锁），
  configure.sh 交互输入经管道、非交互用 --<provider> -
- CodeGraph 客户端监听子进程 stdin error，避免 EPIPE 未处理导致崩溃
- 移除 PI_TOOL_SEARCH/HERMES_MEMORY/RTK_CONFIG_PATH 环境变量入口，测试改用工厂 configPath 注入
- pi-subagents 固定 vitest / coverage-istanbul 4.1.10，修复 npm ls 版本冲突
- 补 pi-web-search / pi-worktree UPSTREAM.md 与 pi-minimal-footer AGENTS.md，
  files 白名单补齐并加测试；.codegraph/.gitignore 移出跟踪
- detect_kitty 优先识别官方安装目录

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-tool-search/README.md

@@ -10,7 +10,7 @@ Generated metadata never replaces executable schemas. Exact names, parameter typ
 
 ## Catalog lifecycle
 
-1. `session_start` keeps `tool_search`, Pi core tools, and configured `alwaysEnabled` names active. PowerShell is filtered out on non-Windows hosts; on Windows it is pinned beside Bash as the same local-shell capability class.
+1. `session_start` keeps `tool_search`, Pi core tools, and configured `alwaysEnabled` names active. PowerShell is filtered out on non-Windows hosts; on Windows it is pinned beside Bash as the same local-shell capability class. Tools whose exposure is `hidden` or `codemode` (script-only, unreachable by the model directly) are excluded entirely; `model-only` tools such as the built-in `codemode` stay reachable and can be pinned.
 2. Hidden tool definitions are hashed with the grouping constraints.
 3. Every tool exposed by the standard `my-pi` bundle is matched against the checked-in catalog in `extensions/bundle-groups.ts`. If all tools are recognized, no model call and no user cache are needed.
 4. User `groupOverrides` take priority over checked-in assignments. Optional or unavailable bundle tools are simply filtered out of their predefined groups.
@@ -41,7 +41,7 @@ Run `/tool-search-status` to inspect the current catalog source, pinned count, d
 | `chrome-interaction` | Chrome click/type/fill/key/hover/drag/tap/scroll input |
 | `chrome-debugging` | Chrome page evaluation, console/network diagnostics, response retrieval, and file upload |
 
-Pinned tools are removed from these dynamic groups at runtime. The defaults pin `codegraph_explore`, `lsp_diagnostics`, and all six Hermes memory tools, so none of them consume dynamic group or tool capacity.
+Pinned tools are removed from these dynamic groups at runtime. The defaults pin `codegraph_explore`, `lsp_diagnostics`, all six Hermes memory tools, `context_tree_query`, `overflow_query`, and `codemode`, so none of them consume dynamic group or tool capacity.
 
 ## Loading and eviction
 
@@ -81,7 +81,8 @@ Pi reads this configuration directly from the installed bundle's `config/tool-se
     "memory_remove",
     "skill_manage",
     "context_tree_query",
-    "overflow_query"
+    "overflow_query",
+    "codemode"
   ],
   "showToolSearchFooterStatus": false,
   "maxActiveGroups": 5,
@@ -93,7 +94,7 @@ Pi reads this configuration directly from the installed bundle's `config/tool-se
 
 | Key | Bundle default | Description |
 |---|---|---|
-| `alwaysEnabled` | CodeGraph explore, LSP diagnostics, all six Hermes memory tools, `context_tree_query`, `overflow_query` | Exact names pinned alongside Pi core tools |
+| `alwaysEnabled` | CodeGraph explore, LSP diagnostics, all six Hermes memory tools, `context_tree_query`, `overflow_query`, `codemode` | Exact names pinned alongside Pi core tools |
 | `showToolSearchFooterStatus` | `false` | Show active tool/group counts |
 | `maxActiveGroups` | `5` | Maximum simultaneously active dynamic groups |
 | `maxToolsPerGroup` | `8` | Maximum size accepted from model-generated groups |