Add opt-in Pi durable harness with bounded sandbox recovery

[mitkox]

Problem

ESF needs an opt-in Pi harness that can recover its internal agent loop inside a surviving Cube microVM while preserving factory verification, evidence ownership, and Temporal's single-attempt agent policy.

Changes

• Add type = "pi" with fixed JSON stdin transport, startup model/endpoint validation, and digest verification of the runner and Node runtime.
• Pin Pi 1.0.3 and its dependency graph; commit the bundled headless runner, generated model catalog, license notices, and candidate inventory.
• Add an exclusive in-VM supervisor with one permitted engine restart, the original deadline, acknowledged shell ownership, and conservative process inspection. Unsafe tools retain unsafe replay policy.
• Capture bounded, redacted terminal/usage/recovery artifacts before teardown. Incomplete usage remains unavailable; model-rate cost is explicitly estimated.
• Extend CubeEgress policy, template verification, offline installation, SBOM generation, CI, and operator documentation. Keep Pi opt-in with candidate status.

Verification

Executed project code and tests inside local CubeSandbox microVMs:

• npm ci --ignore-scripts, npm run build, node export-catalog.mjs, npm test: 16 runner regressions passed; rebuilding reproduced the committed runner digest.
• npm audit --audit-level=high: zero vulnerabilities.
• Existing internal/agentharness, internal/factory, and cmd/factory suites passed with the race detector. Test binaries were compiled with go test -c -race and executed inside Cube; final model/pricing changes also passed focused regressions.
• factory agents verify, candidate inventory verification, offline installation with the template's Python 3.10, and modified-runner digest rejection passed.
• Actual deterministic factory workflows covered successful completion, expected verification failure, blocked-task handling, and review suspend/resume; audit and usage artifacts were retained and every run verified zero remaining sandboxes.
• Generated CycloneDX SBOM: 499 components.
• Host static checks: go vet ./internal/agentharness ./internal/factory ./cmd/factory and git diff --check passed.

Risks

Pi 1.0.3 exposes an experimental API. Recovery covers confirmed engine death in a surviving sandbox; active shell execution, surviving processes, uncertain inspection, lost state, and supervisor failure remain failed runs. It does not guarantee exactly-once tool effects.

This PR remains a draft pending model-backed qualification. The local gateway was unreachable; an HTTPS provider/model/credential profile and approved custom-model limits are still required. Real-model acceptance and same-task/model comparisons with OpenCode and Unreal remain pending. Deterministic results do not establish production readiness.

• The change is focused and contains no unrelated cleanup.
• Tests and documentation cover changed behavior.
• Logs, fixtures, and screenshots contain no secrets or private repository data.