fix(pi): support isolated subscription auth

[drewstone]

Outcome

Pi built-in models now use Pi’s canonical RPC catalog and subscription bearer flow without exposing the real credential to the coding process. The trusted proxy pins the selected model, rewrites Codex account identity, refreshes credentials safely, and cancels billed upstream work when the caller disconnects.

Security

• Catalog lookup receives only the shared Pi environment allowlist.
• Catalog processes are isolated into a process group, awaited, and killed after lookup.
• Zstd inspection is asynchronous, limited to 32 MiB, and limited to two concurrent decodes per proxy.
• Dynamic catalog fallback cannot bypass custom provider auth settings.
• Synthetic child credentials and account IDs are replaced only inside the trusted loopback proxy.

Proof

• pnpm typecheck
• pnpm test -- --reporter=basic: 966 passed, 12 skipped
• Real Pi + Tangle Router + GLM 5.2: two retained turns and native boundary proof passed in 9.73 s
• Focused isolation suite: 30 passed, 1 skipped