fix(security): honor Pi project permission settings

[WAIXv]

Summary

• resolve project permission settings according to the detected adapter
• support Pi project-level permissions in .pi/settings.json
• retain Claude project settings as a compatibility fallback
• add coverage for Pi allow/deny behavior and legacy compatibility

Testing

• npm run typecheck
• targeted security, project-boundary, Pi adapter, and config tests passed
• full suite: 4702 passed, 46 skipped; one unrelated Windows cache-heal test was flaky due to a stale breadcrumb realpath ENOENT

Compatibility

Claude Code projects continue to use .claude/settings.local.json and .claude/settings.json. Pi projects can now keep permission rules in .pi/settings.json.