feat: add first-class Pi harness support

[awesamarth]

Summary

Adds Pi as a first-class Centaur harness across the harness server, API runtime,
Slack, Console, sandbox, Helm chart, and documentation.

The sandbox previously bundled
@mariozechner/pi-coding-agent@0.67.2 as a standalone tool. This updates it to
@earendil-works/pi-coding-agent@0.84.2 and integrates its long-lived JSONL RPC
mode with Centaur.

What changed

• Add a long-lived Pi RPC adapter to harness-server
• Normalize streamed text, reasoning, tool calls/results, usage, and errors
• Support steering, interruption, images, provider/model overrides, and stable sessions
• Add pi to API/runtime/CLI harness types and the SQL session enum
• Add Slack --pi, channel defaults, metadata, and model/reasoning handling
• Add Pi to the Console composer and thread labels
• Propagate PI_MODEL and PI_THINKING through Helm
• Seed Pi OAuth from existing broker placeholders without exposing credentials
• Document Pi configuration and usage

Pi defaults to CODEX_MODEL and CODEX_MODEL_REASONING_EFFORT when its own
environment overrides are absent.

Validation

• Harness-server tests and clippy
• API core/runtime/server tests and clippy
• Slackbot tests and TypeScript typecheck
• Console controller tests: 100 runs, 302 assertions, 0 failures
• Sandbox auth tests
• Helm lint
• Full sandbox, API, Slackbot, and Console image builds
• Real Pi OAuth container smoke test
• End-to-end Kind API → sandbox → Pi execution returning PI_API_OK