feat: 接入 Pi 内置 codemode，并修复全面审查发现的问题

- codemode：Tool Search 常驻（alwaysEnabled）、权限 allow（嵌套调用仍逐个过权限门）、
  tools.jsonc 登记使用规则；RTK 跳过 parentToolCallId 嵌套调用，避免丢失 bash
  structuredContent；Tool Search 目录过滤 hidden / codemode（script-only）exposure；
  扩展加载测试加载 builtin:codemode 并断言其常驻激活
- 搜索 key 不再经命令行参数传递：search-auth.mjs 改为 --set-stdin（先读校验再加锁），
  configure.sh 交互输入经管道、非交互用 --<provider> -
- CodeGraph 客户端监听子进程 stdin error，避免 EPIPE 未处理导致崩溃
- 移除 PI_TOOL_SEARCH/HERMES_MEMORY/RTK_CONFIG_PATH 环境变量入口，测试改用工厂 configPath 注入
- pi-subagents 固定 vitest / coverage-istanbul 4.1.10，修复 npm ls 版本冲突
- 补 pi-web-search / pi-worktree UPSTREAM.md 与 pi-minimal-footer AGENTS.md，
  files 白名单补齐并加测试；.codegraph/.gitignore 移出跟踪
- detect_kitty 优先识别官方安装目录

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/bundle-config.test.ts

@@ -13,10 +13,7 @@ import {
   getToolSearchCatalogPath,
   getToolSearchConfigPath,
 } from "../pi-tool-search/extensions/config.ts";
-import {
-  CONFIG_PATH as RTK_CONFIG_PATH,
-  resolveConfigPath as resolveRtkConfigPath,
-} from "../pi-rtk-optimizer/src/constants.ts";
+import { CONFIG_PATH as RTK_CONFIG_PATH } from "../pi-rtk-optimizer/src/constants.ts";
 import { CONFIG_PATH as COMPACTION_CONFIG_PATH } from "../pi-compaction/src/config.ts";
 import { WORKTREE_CONFIG_PATH } from "../pi-worktree/src/settings.ts";
 import { resolvePreamblePath } from "../extensions/system-prompt-config.ts";
@@ -75,33 +72,21 @@ test("every bundle JSON/JSONC config file parses", async () => {
 });
 
 test("each extension resolves its config path inside the bundle config/ dir", () => {
-  const savedToolSearch = process.env.PI_TOOL_SEARCH_CONFIG_PATH;
-  const savedRtk = process.env.PI_RTK_CONFIG_PATH;
-  delete process.env.PI_TOOL_SEARCH_CONFIG_PATH;
-  delete process.env.PI_RTK_CONFIG_PATH;
-  try {
-    const inBundleConfig = (resolved: string, file: string) =>
-    assert.equal(
-      resolved,
-      join(bundleConfigDir, file),
-      `expected the bundle config path for ${file}`,
-    );
+  const inBundleConfig = (resolved: string, file: string) =>
+  assert.equal(
+    resolved,
+    join(bundleConfigDir, file),
+    `expected the bundle config path for ${file}`,
+  );
 
-    inBundleConfig(getGlobalConfigPath(), "pi-permission-policy.jsonc");
-    inBundleConfig(getHardGuardConfigPath(), "pi-permission-hard-guards.jsonc");
-    inBundleConfig(getToolSearchConfigPath(), "tool-search.json");
-    inBundleConfig(RTK_CONFIG_PATH, "rtk-optimizer.json");
-    inBundleConfig(resolveRtkConfigPath(), "rtk-optimizer.json");
-    inBundleConfig(COMPACTION_CONFIG_PATH, "pi-compaction.json");
-    inBundleConfig(WORKTREE_CONFIG_PATH, "pi-worktree.json");
-    inBundleConfig(HERMES_CONFIG_PATH, "pi-hermes-memory.json");
-    inBundleConfig(resolvePreamblePath(), "prompt/preamble.md");
-  } finally {
-    if (savedToolSearch === undefined) delete process.env.PI_TOOL_SEARCH_CONFIG_PATH;
-    else process.env.PI_TOOL_SEARCH_CONFIG_PATH = savedToolSearch;
-    if (savedRtk === undefined) delete process.env.PI_RTK_CONFIG_PATH;
-    else process.env.PI_RTK_CONFIG_PATH = savedRtk;
-  }
+  inBundleConfig(getGlobalConfigPath(), "pi-permission-policy.jsonc");
+  inBundleConfig(getHardGuardConfigPath(), "pi-permission-hard-guards.jsonc");
+  inBundleConfig(getToolSearchConfigPath(), "tool-search.json");
+  inBundleConfig(RTK_CONFIG_PATH, "rtk-optimizer.json");
+  inBundleConfig(COMPACTION_CONFIG_PATH, "pi-compaction.json");
+  inBundleConfig(WORKTREE_CONFIG_PATH, "pi-worktree.json");
+  inBundleConfig(HERMES_CONFIG_PATH, "pi-hermes-memory.json");
+  inBundleConfig(resolvePreamblePath(), "prompt/preamble.md");
 });
 
 test("disposable runtime state stays under the agent-dir my-pi tree", () => {