Add the pi harness: lightweight local-model agents with full gate parity

Model backend rows gain a harness column (claude | pi). A pi-harness row runs
the agent through the pi coding agent instead of the claude binary — pi speaks
the OpenAI Completions API natively, so a bare vLLM/llama.cpp/Ollama endpoint
needs no LiteLLM/claude-code-router translation proxy, and the loop is far
lighter for slow local token throughput. The Claude subscription and existing
claude-harness backends are untouched.

Parity comes from generated per-agent artifacts under ~/.handler-pi (outside
the repo tree, so the clean-tree gate never trips): models.json + settings.json
render the row as a pi provider pinned as the default model; a bundled bridge
extension (pi_bridge.ts) adapts pi's events to the exact stdin/stdout contract
of `python -m handler.hooks` — the Stop/completion gate re-prompts pi with
blockers via a follow-up message, git push runs the test/build/approval gates
and denies on failure, questions defer through an ask_operator tool into the
normal answer/resume flow, and memory recall is injected at session start. The
memory tools are registered natively (pi has no MCP), shelling to a new
`python -m handler.mcpserver --call <tool>` seam that reuses the MCP server's
implementations. Skills reuse the same ~/.claude/skills sync (pi implements the
same SKILL.md standard) plus the repo's committed .claude/skills.

Sessions are single JSONL files pre-assigned via --session, so cross-worker
resume archives/materializes exactly like claude's; the prompt travels on stdin
(pi has no -- separator). The supervisor normalizes pi's event stream on the
fly: assistant message_end feeds last_output, the final agent_end becomes the
run result. The whole chain was validated live against pi 0.84.1 with a stub
OpenAI endpoint: memory injection, push-gate denial (including the protected-
branch approval gate), stop-gate block loop, and ask_operator pause all ran
end to end through the real hooks and DB.

Also: harness selector in the dashboard Models form, pi baked into the control
image (NodeSource 22 for pi's node >= 22.19 floor), PI_BIN override, docs in
docs/local-models.md, fake_pi fixture + 12 tests (361 total green).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KdGv3u3DfTsP1S188KDhVH

Dockerfile.control

@@ -39,11 +39,14 @@ FROM python:3.11-slim
 #   tmux                  — one detached session per agent (and per login attempt)
 #   node + claude         — the Claude Code CLI the agents *are*, and the /login flow the
 #                           dashboard drives (see control/login.py)
+#   pi                    — the lightweight pi coding agent (harness='pi' model backends,
+#                           see control/pi_harness.py); speaks OpenAI-compatible endpoints
+#                           natively, so local vLLM/llama.cpp backends need no proxy
 #   mise                  — the per-project task runner the test/build gates invoke
 #   forge                 — the cross-forge CLI the CI poller reads run status from
-# Node comes from NodeSource (>=18 is required by Claude Code); mise from its official apt
-# repo; forge from the build stage above. Installed under /usr/{bin,local/bin} — outside the
-# /var/lib/handler VOLUME — so the volume mount never masks them at runtime. The image is
+# Node comes from NodeSource (>=18 for Claude Code, >=22.19 for pi); mise from its official
+# apt repo; forge from the build stage above. Installed under /usr/{bin,local/bin} — outside
+# the /var/lib/handler VOLUME — so the volume mount never masks them at runtime. The image is
 # built for amd64 and arm64: NodeSource + forge detect the arch, and the mise apt source is
 # pinned to `dpkg --print-architecture` (the image's own arch) so the arm64 build pulls the
 # arm64 package, not an amd64 one.
@@ -51,9 +54,10 @@ RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         git tmux openssh-client curl ca-certificates gnupg \
     && install -dm 755 /etc/apt/keyrings \
-    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && npm install -g @anthropic-ai/claude-code \
+    && npm install -g --ignore-scripts @earendil-works/pi-coding-agent \
     && npm cache clean --force \
     && curl -fsSL https://mise.jdx.dev/gpg-key.pub \
         | gpg --dearmor -o /etc/apt/keyrings/mise-archive-keyring.gpg \