fix(pi): preserve exact profiles in confined runs

[drewstone]

Fixes the real Pi + AgentProfile path used by Discovery when filesystem read confinement is enabled.

• Honor custom PI_CODING_AGENT_DIR as the sole Pi config source and redirect the confined child to its mounted location.
• Resolve explicit Pi extensions through that same in-confined-run location.
• Apply path translation only after the execution layer proves confinement is active; host, Docker, and explicit warn-fallback argv remain unchanged.
• Grant run-scoped project trust for exact profile resources while keeping ambient context, skills, and prompt templates disabled; calls without a profile are unchanged.
• Add Linux, macOS, missing-custom-dir, active-translation, fallback-preservation, extension-path, task-integrity, and no-profile regressions.

Proof at ccd2b04:

• 592 tests passed; 6 skipped.
• TypeScript passed.
• cli-bridge verification passed.
• Filesystem-confinement checks: 8/8 passed.
• Live Pi -> Tangle Router -> DeepSeek V4 Flash with an inline AgentProfile skill plus explicit pi-mcp-adapter returned PROFILE_REWRITE_FINAL_OK (5,009 tokens).
• Pi settings/models/auth SHA-256 hashes were unchanged.
• DeepSeek V4 Flash found the unavailable-jail fallback defect in the first head; the second commit fixes it in the execution layer and pins both active and fallback behavior.

No Claude or Codex model was used.

[drewstone]

Independent DeepSeek V4 Flash review of exact head ccd2b04dceaed4f6ca5bdb93d95e6e956e3afbd3: APPROVE.

The previous blocker is resolved at the execution layer: unavailable-jail warn fallback returns the original host argv before rewriting; Docker never applies the OS-jail rewrite; an active OS jail rewrites only exact extension paths immediately following --extension; and a user task equal to that path is unchanged. Custom PI_CODING_AGENT_DIR, run-scoped --approve, mounts, and translated paths agree. No blocking source finding.

Exact-head proof: GitHub test passed; local suite 592 passed / 6 skipped; filesystem-jail suite 8/8; focused suite 79/79; TypeScript and package verification passed. A live isolated Pi + DeepSeek V4 Flash run loaded an inline AgentProfile and explicit MCP adapter under filesystem confinement, returned PROFILE_REWRITE_FINAL_OK with HTTP 200 and 5,009 tokens, and left settings/model/auth files unchanged.