fix(sandbox): follow managed Pi updates safely

[mike-diff]

Summary

Support Pi's managed installation without requiring a second npm installation. After pi update, the next ghafk agent run follows the selected release.

• Resolve only the known ~/.pi/agent/bin/pi launcher, including a PATH symlink, for the existing pi profile.
• Validate the releases-v1 marker, bounded version file, package identity/version, executable entrypoint, and dependency tree.
• Pin the Pi entrypoint and Node executable before launch. Prefer the installer's managed Node, matching Pi's launcher, then fall back to PATH.
• Expose only the selected release's node_modules read-only. Never execute the launcher or expose the surrounding credential/installer tree.
• Reject escaping links, hard-linked/non-regular runtime files, invalid layouts, and executables inside repositories ghafk works on.
• Document setup, updates, migration away from a separate-copy override, security limits, and troubleshooting.

This follows up on the sandbox setup failure encountered while working issue #35; it does not change the /help feature.

Security boundaries

The bind: validator, protected credential directories, credential-copy behavior, git isolation, and network allowlists remain unchanged. The runtime exception is scoped to a validated managed Pi release and does not apply to raw commands or unrelated profiles.

Metadata validation is not package-authenticity verification. As with other harnesses, the user's installer and installed executable code remain trusted. Missing or unsupported layouts fail closed rather than broadening access.

Validation

• go test -count=1 -v -run '^TestManagedPI' .
• go build ./...
• go vet ./...
• test -z "$(gofmt -l .)"
• go test -count=1 ./...
• go run honnef.co/go/tools/cmd/staticcheck@latest ./...
• go test -race -count=1 -run '^TestManagedPI' .
• macOS/arm64 cross-build
• Markdown links/anchors and shell example syntax
• Live managed Pi 1.0.3 model smoke test using the timer's PATH and the built-in pi profile: file edit, shell execution, reply parsing, and usage parsing all passed.

Tests cover release switching without retargeting a prepared sandbox, installer-Node selection with/without a PATH Node, invalid metadata and entrypoints, credential/repository links, hard links, profile scoping, hidden host state, read-only runtime code, and the macOS policy's narrow read grants.

Linux isolation was exercised locally. The GitHub Actions test jobs have now passed on both ubuntu-latest and macos-latest: https://github.com/mike-diff/ghafk/actions/runs/37389732227.

Deployment

Not deployed. The running timer, installed ghafk binary, and temporary separate-Pi workaround remain unchanged pending review. After installing the reviewed change, remove only the separate-copy pi: override to use the managed installation.