fix(pi): isolate writable configuration in jailed runs

[drewstone]

What changed

• copy Pi's active agent directory to a request-unique writable directory only when filesystem confinement is active
• point the confined child at that copy while preserving the normal environment on an unconfined fallback
• load Pi extensions from the same copied directory and remove copies after completion or failed setup
• clean dead-process copies without age limits, and preserve concurrent stable auth directories

Why

Pi locks and updates its settings. A read-only bind made real confined Pi runs fail before inference, while sharing one writable directory would let concurrent runs alter each other.

Checks

• pnpm typecheck
• pnpm test — 595 passed, 6 skipped
• pnpm verify — 6 configured backends ready
• pnpm verify:fs-jail — 8/8 checks passed
• focused follow-up — 51 jail tests passed
• DeepSeek V4 Flash through Pi/Tangle Router: APPROVE; no medium-or-higher findings