feat: 接入 Pi 内置 codemode，并修复全面审查发现的问题

- codemode：Tool Search 常驻（alwaysEnabled）、权限 allow（嵌套调用仍逐个过权限门）、
  tools.jsonc 登记使用规则；RTK 跳过 parentToolCallId 嵌套调用，避免丢失 bash
  structuredContent；Tool Search 目录过滤 hidden / codemode（script-only）exposure；
  扩展加载测试加载 builtin:codemode 并断言其常驻激活
- 搜索 key 不再经命令行参数传递：search-auth.mjs 改为 --set-stdin（先读校验再加锁），
  configure.sh 交互输入经管道、非交互用 --<provider> -
- CodeGraph 客户端监听子进程 stdin error，避免 EPIPE 未处理导致崩溃
- 移除 PI_TOOL_SEARCH/HERMES_MEMORY/RTK_CONFIG_PATH 环境变量入口，测试改用工厂 configPath 注入
- pi-subagents 固定 vitest / coverage-istanbul 4.1.10，修复 npm ls 版本冲突
- 补 pi-web-search / pi-worktree UPSTREAM.md 与 pi-minimal-footer AGENTS.md，
  files 白名单补齐并加测试；.codegraph/.gitignore 移出跟踪
- detect_kitty 优先识别官方安装目录

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/codegraph.test.ts

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { EventEmitter } from "node:events";
 import {
 	execFileSync,
 	spawn,
@@ -13,6 +14,7 @@ import {
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { PassThrough } from "node:stream";
 import { fileURLToPath } from "node:url";
 import test from "node:test";
 
@@ -278,6 +280,38 @@ test("client close() terminates the child process", async () => {
 	}
 });
 
+test("a stdin EPIPE after child death rejects pending requests without throwing", async () => {
+	const dir = await mkdtemp(join(tmpdir(), "my-pi-codegraph-"));
+	const child = new EventEmitter() as ChildProcess;
+	child.stdin = new PassThrough();
+	child.stdout = new PassThrough();
+	child.stderr = new PassThrough();
+	child.exitCode = null;
+	child.signalCode = null;
+	const client = new CodegraphRpcClient({
+		root: dir,
+		spawn: () => child,
+		requestTimeoutMs: 5_000,
+	});
+	try {
+		const start = client.start();
+		await sleep(20);
+		// Without the stdin "error" listener this emit throws uncaught.
+		child.stdin.emit(
+			"error",
+			Object.assign(new Error("write EPIPE"), { code: "EPIPE" }),
+		);
+		child.exitCode = 1;
+		child.emit("exit", 1, null);
+		child.emit("close", 1, null);
+		await assert.rejects(start, /子进程退出/);
+		assert.equal(client.dead, true);
+	} finally {
+		await client.close();
+		await rm(dir, { recursive: true, force: true });
+	}
+});
+
 // ── handler ─────────────────────────────────────────────────────────────────
 
 test("indexed project explores through the serve child", async () => {