feat: add Pi JSON-mode provider engine

[EivMeyer]

Problem

Pi is documented as the first non-current engine candidate, but Zeroshot cannot run it. The first integration should use Pi JSON mode because it matches Zeroshot's existing spawn/capture provider-helper boundary.

Pi must remain an engine behind the provider boundary. Zeroshot keeps orchestration, worktrees, retries, evidence, PR/ship behavior, and completion authority.

Approach

Implementation details

• Add pi through the provider-engine registry from feat: make adding provider engines a single-registry change #593.
• Pin/probe the Pi CLI or package version used by the adapter.
• Build a Pi adapter for probe, build-command, parse-output, classify-error, and invoke through the existing helper contract.
• Start with conservative capabilities: no session resume, no MCP parity, no persistent sessions, no blocking hooks, no inferred cost unless fixtures prove it.
• Use Pi JSON event stream mode only for the first pass.
• Disable package, extension, context, and prompt auto-discovery unless explicitly passed by Zeroshot.
• Treat global ~/.pi as local-only. Docker/hosted paths require explicit isolated config or env injection.

Acceptance Criteria

• zeroshot providers lists Pi when the Pi CLI/package is installed and probe passes.
• Pi JSON fixtures cover text output, tool call/result, command failure, auth failure, rate limit, cancellation, and empty/no-event output.
• Pi failures classify as retryable, permanent, auth, or rate-limit without leaking secrets.
• Pi can run one noninteractive task in a worktree and produce normalized Zeroshot events.
• Pi adapter reports conservative capabilities and fails closed for unsupported resume/MCP/persistent-session behavior.
• Existing Claude/Codex/Gemini/Opencode behavior does not change.

Verification

Required commands

npm run build:agent-cli-provider
npm run test:agent-cli-provider
npm run typecheck:agent-cli-provider
npm run check:agent-cli-provider

Dependencies

• Depends on feat: make adding provider engines a single-registry change #593.

Non-goals

• Do not add Pi RPC transport in this issue.
• Do not embed the Pi SDK in the Zeroshot runtime process.
• Do not use global ~/.pi as hosted credential source.

[EivMeyer]

Implemented and merged in #600.