deps: migrate pi agent suite to @earendil-works (closes remaining advisories)

[ApiliumDevTeam]

Summary

Migrates the core agent runtime from the deprecated @mariozechner/pi-* packages to their maintained successor @earendil-works/pi-* (^0.80.2).

This closes the 3 remaining Dependabot advisories that PR #62 could not fix: the old @mariozechner/pi-coding-agent is deprecated and its latest published version (0.73.1) is still vulnerable, so a version bump was impossible — the fixes only exist under the new @earendil-works scope.

After this change pnpm audit reports no @mariozechner/pi or pi-coding-agent finding, and @earendil-works has 0 advisories.

What changed

• Renamed all imports @mariozechner/pi-* → @earendil-works/pi-* across src/, extensions/, scripts/, skills/, docs/ and the mac packaging script. Bumped the 4 root deps to ^0.80.2.
• Adapted to the 0.54 → 0.80 API (146 type errors resolved at root cause; no any/@ts-ignore/suppression):
  • pi-ai — legacy helpers (complete, completeSimple, stream, streamSimple, getModel, getEnvApiKey, streamOpenAIResponses) moved to the @earendil-works/pi-ai/compat subpath; OAuth helpers to @earendil-works/pi-ai/oauth; deep /dist/... imports repointed (types → root, google-shared → /api); onPayload is now (payload, model); ProviderHeaders allows null; typebox re-exported from pi-ai.
  • pi-tui — dropped the Editor infix (getKeybindings/setKeybindings/KeybindingsConfig/KeybindingsManager); KeybindingsManager(definitions, userBindings?); namespaced keybinding ids (tui.select.cancel); async 4-arg AutocompleteProvider.getSuggestions.
  • pi-coding-agent — codingTools → createCodingTools(cwd); Skill.source → Skill.sourceInfo.source; ModelRegistry.create(...) + getApiKeyForProvider(...); generateSummary gained a headers? param; createAgentSession({ tools }) is now a name allowlist (string[]).
  • pi-agent-core — agent.replaceMessages(...) / setSystemPrompt(...) → agent.state.messages / agent.state.systemPrompt.
• pnpm.overrides += "@apilium/mayros": "workspace:*" — the bluebubbles plugin peer-depends on @apilium/mayros, which pnpm was satisfying with the published 0.1.1 that bundled the old vulnerable pi suite. Forcing the peer to the workspace package removes that nested copy entirely (it was the source of the last 3 advisory instances).

Relationship to #62

Independent branch off dev. #62 (overrides for the other ~137 advisories) and this PR are complementary; with both merged, pnpm audit should be at ~0.

Verification

• pnpm install — clean.
• pnpm tsgo — 0 errors (from 146).
• pnpm lint — 0 errors (pre-existing warnings only).
• oxfmt — changed files formatted.
• pnpm audit — 0 pi-coding-agent / @mariozechner/pi / @earendil-works findings.

⚠️ Needs a full CI run + manual smoke test before merge. This touches the core agent runtime across ~226 files and is a 0.54 → 0.80 API jump. Type-checking and linting pass, but I could not run the full test suite here (native deps + live provider keys). Please run pnpm test / pnpm test:e2e and smoke-test a live agent session (incl. TUI keybindings, OAuth logins, compaction, and tool calls) before merging.