fix(pi): validate Pi 1.0.4 runtime compatibility

[heggria]

Final-head verification

Head 063282bc41ab233ca2d50f7dde8f0d88e86b31e8 passed all 13 CI jobs and the Plugin Security Scan.

• Node 22 Pi matrix: 254 adapter tests passed, 0 skipped in each of 0.80.3 / 0.85.1 / 1.0.4. Real installed CLI checks: 12 / 12 / 14 passed, respectively.
• Full Node 22/24 suites, all-package build, packed consumers, cross-platform process supervision, MCP E2E, website and CodeQL passed.
• Scanner: 81/100; 0 critical, 0 high, 5 medium, 9 low, 5 info. Cisco skill scanning completed with balanced policy and static_analyzer/bytecode/pipeline; optional Cisco MCP deep scanning remains unavailable and is not claimed as covered. Existing residual findings remain visible.
• The first scan flagged a constant fake API key in the local provider fixture. It was replaced with a per-test generated handshake token. No scanner pins, thresholds or suppressions changed.
• Final remote tree a50a70b1fbcdcffea4073cb2b87aa65b63d97f0c matches the local tree; working checkout is clean.

Problem

The existing 208 Pi adapter tests pass against Pi 1.0.4, but actual CLI coverage exposed runtime gaps on main 95763fda9660be4b4d8b322534dd83ec07a797fc:

• A provider 429 is treated as immediately fatal, terminating Pi before its retry can recover; compaction does not reliably revoke terminal reaping.
• RPC approval uses a TUI-only custom component and does not request a human decision. Missing dialog results can fall through to approval.
• With MCP explicitly loaded, Pi 1.0.4 keeps MCP tools callable through codemode even when Taskflow's explicit tool list does not include them. Reproduced using a harmless local stdio MCP server and a real codemode call.

Changes

• Retain attempt errors until recovery or final settlement; handle retry/compaction activity while preserving legacy clean exits, aborts and watchdogs.
• Use RPC select/input dialogs, retain the TUI overlay, and reject cancelled/unavailable dialogs and cancelled edits.
• Add --exclude-tools mcp__* for explicit tool lists without * or an explicit mcp__... entry. Explicit MCP namespace patterns remain functional.
• Add an independent CI matrix for Pi 0.80.3 / 0.85.1 / 1.0.4, verifying all four adapter-local SDK resolutions, running the entire adapter suite, building the extension, and running the actual installed CLI.
• Document tested versions, coverage and tool-filter semantics.

The narrowly scoped lifecycle/approval adaptation and regression cases reuse already prepared work from #142. This PR does not advance that release or bring its Control Plane, recovery, schema, usage-accounting or other changes into main. It does not merge #174 or include its dependency/Actions upgrades. Public peer ranges, adapter/root dependency pins, committed lockfile, release versions and existing action pins are unchanged.

Validation

Local Node 24.19.0, pnpm 11.25.0 (CI uses the repository-pinned pnpm and Node 22):

Official Pi version	Complete adapter suite	Real CLI checks
0.80.3	254 passed, 0 skipped	12 passed
0.85.1	254 passed, 0 skipped	12 passed
1.0.4	254 passed, 0 skipped	14 passed

• Core + adapter builds pass for all three versions.
• Typecheck passes with Pi 1.0.4 and again after restoring the frozen main dependency baseline.
• Real CLI checks cover built extension dispatch, owning persisted run ID reaching a JSON child, direct identity, shared-context extension/tool filtering, actual retry recovery, six RPC decision/cancellation paths, and headless rejection preventing downstream execution.
• Pi 1.0.4 adds actual MCP/codemode positive and negative controls, explicit MCP wildcard inclusion and read-tool filtering. Legacy versions do not claim native MCP/codemode coverage.
• Lifecycle regressions before the fix: 17 failures / 21 tests. Actual CLI separately reproduced early termination and missing RPC approval, and the MCP negative control reproduced an unlisted tool call.
• git diff --check passes; final tree equality and remote evidence are recorded above.

Model responses are supplied at the provider boundary by a deterministic local fixture. These are real Pi CLI/protocol/process tests, not live-provider authentication, clean-consumer tarball, or interactive TUI visual acceptance. Remote CI results must be assessed at this PR's head; historical #174/#142 greens are not reused.

Keep this PR independent and draft for review; current-head CI is green. No merge, tag or publication is requested here.