Upgrade the Pi SDK and refresh its model catalog

[amadad]

Summary

• Move BB's Pi bridge and server inference helpers from @mariozechner/pi-* 0.70.5 to @earendil-works/pi-* 0.82.0.
• Use one shared ModelRuntime for model resolution, authentication, session creation, and catalog refresh. The picker now reflects each model's supported reasoning levels, including max.
• Keep retryable Pi failures inside the active BB turn by honoring agent_end.willRetry.
• Bundle Pi's jiti/static dependency and register Pi's static OAuth loaders so the standalone bridge can authenticate without filesystem-only dynamic imports.
• Raise the supported Node.js floor to 22.19 and remove the Node 20 compatibility job and shim.

Why

BB was pinned to Pi 0.70.5 under the retired package namespace. Its static model APIs could not expose models added through Pi's current catalog. The new runtime API keeps session and catalog behavior under one owner while preserving BB's existing bridge protocol.

The server pins @opentelemetry/api to the workspace version so Pi AI and Drizzle resolve one shared type identity.

Compatibility

• Supported Node.js versions are 22.19, 24, and 26.
• Pi remains an SDK bundled with BB. This does not switch the provider to an independently installed Pi CLI.
• The server-to-daemon wire contract is unchanged, so this does not require a host daemon protocol bump.

Verification

• pnpm install --frozen-lockfile
• pnpm exec turbo run build typecheck lint --concurrency=1 --force (68 tasks)
• Agent runtime: 41 files, 803 tests
• Server: 148 files, 1,255 tests
• bb-app: 2 files, 47 tests
• pnpm exec turbo run smoke:tarball --filter=bb-app --force
• Bundled OAuth probe: stored openai-codex credentials resolve inside the single-file bridge
• Packaged Pi bridge model discovery: 96 models, including six GPT-5.6 variants; eight models advertise max

[amadad]

Live testing exposed one bundle-only OAuth failure: Pi’s lazy OAuth loader resolved ./openai-codex.js relative to the generated single-file bridge. Commit 5e157ef7 registers Pi’s static OAuth loaders at bridge startup.

Proof: the regression test failed before the change and passes after it; all 803 agent-runtime tests pass; the tarball smoke passes; and a bundled openai-codex/gpt-5.6-luna turn completed successfully with stored OAuth credentials.