fix(pi): isolate model credentials from agent tools

[drewstone]

What changed

• resolve Pi's exact provider/model credential in the trusted bridge before spawn
• give Pi a request-scoped loopback token instead of daemon provider or GitHub credentials
• require a real Linux read-confined host process and prevent the warn fallback from disabling it
• keep one opaque native Pi session directory per caller session, outside the readable workspace
• count every scoped proxy request and refuse unrecorded, rejected, failed, or unfinished traffic
• include endpoint, call counts, tokens, prompt-cache usage, and unknown billed USD in the completed exact-profile receipt

Why

Pi previously inherited daemon environment variables and could read the host Pi config and sibling session files through Bash. That made an exact AgentProfile non-exact at the credential and storage boundaries, and model calls made with a copied local token were not independently counted.

Proof

• pnpm test: 633 passed, 7 skipped
• pnpm typecheck: passed
• pnpm verify: passed
• pnpm verify:fs-jail: blocked host secret files, sibling directories, and the host repo while allowing workspace writes, Node, Python, and localhost
• real Pi 0.83.0 Bash attack: daemon credential env, known host credential paths, controlled secret bytes, and sibling Pi sessions were inaccessible; native session continuation succeeded
• adversarial real Pi tool call: a direct extra proxy request produced 3 forwarded calls versus 2 Pi usage receipts, emitted the failed receipt, and refused completion
• live exact profile through Tangle Router deepseek-v4-flash: profile sha256:c544b78bd906d1e2b75a9a8b5b888b9cb59b3d802805c75ad8fc656babd941dc; second turn had 9,900 input tokens (44 fresh, 9,856 cache-read), 21 output tokens, 1/1 call accounting, 0 rejected/failed/in-flight, and costKnown: false

Operational impact

Pi now requires PI_EXECUTOR=host, execution.jail.mode=fs-jail, and working bubblewrap. Docker and undeclared custom executors refuse before auth rather than mounting credentials or running without read isolation.