feat: add pi-yaml-hooks support (YAML hooks for pi)

[ryaneggz]

What

Adds pi-yaml-hooks support to the harness — event-driven YAML hooks for the pi coding agent, adapted from KristjanPikhof/Pi-YAML-Hooks examples/.

Approach (scope decisions)

Advisor-guided. The three upstream example packs were triaged rather than dumped in wholesale:

Pack	Decision	Why
engine (pi-yaml-hooks npm)	Install — pinned in .pi/settings.json packages[]	Idiomatic thin package pin (same model as sibling pi packages)
post-tool-developer-feedback	Adapted → active hook (.pi/hook/hooks.yaml)	Non-blocking, genuinely useful proof-of-usability
pre-tool-developer-guards	Vendored reference-only, NOT wired	Fully superseded by .pi/extensions/path-guard.ts; wiring it would double-fire confirmations
atomic-commit-snapshot-worker	Not vendored (pointer only)	Repo-only, destructive auto-commit, ~3.4k LOC of fcntl/signal Python

Changes

• .pi/settings.json — pin npm:pi-yaml-hooks@2026.6.14; settings.test.ts updated in lockstep (the array is asserted with toEqual).
• .pi/hook/hooks.yaml — active hook: NDJSON audit log (tool.after.write|edit under harness source areas) + setStatus on dependency-file changes. Deliberately observe-only: no bash blocking, no tool: prompt injection (would interfere with autopilot/cron pi sessions).
• .pi/hook/post-tool-log.mjs — audit-log helper (writes git-ignored .pi-hook-logs/).
• .pi/hook/README.md — provenance, event/action/condition schema, trust model, and why packs 1/3 aren't wired.
• .pi/hook/examples/pre-tool-developer-guards/ — vendored reference pack.
• .gitignore — ignore .pi-hook-logs/.
• .pi/UPSTREAM.md — tracking entry (MIT, quarterly review, lockstep-bump note).

⚠️ Trust decision (operator-facing)

Project hooks are inert until the repo is trusted via /hooks-trust or PI_YAML_HOOKS_TRUST_PROJECT=1. This PR does not auto-trust globally — that would change behavior across every pi session (autopilot, cron, slack bridge) and is left as an explicit operator choice, documented in .pi/hook/README.md. The engine loads everywhere via the pin, but hooks.yaml does nothing until trusted.

Verification

• node_modules/.bin/vitest run .pi/extensions/__tests__/ → 57 passed (incl. settings.test.ts with the new pin).
• node --check on both .mjs helpers; active hooks.yaml confirmed free of command: actions (rejected by pi at load).
• npm view pi-yaml-hooks version → 2026.6.14 (pin verified against registry, not guessed).

🤖 Generated with Claude Code

[ryaneggz]

Closing as superseded by #655 (merged as 0eaa152), which adopted cc-safety-net@1.0.6 as the canonical cross-provider bash guard and retired path-guard.ts's RISKY_BASH branch.

Why close rather than rebase:

• This PR conflicts with feat: adopt cc-safety-net as cross-provider destructive-command guard (#654) #655 in .pi/settings.json (packages array) and .pi/extensions/__tests__/settings.test.ts.
• The vendored pre-tool-developer-guards reference pack was justified as "superseded by path-guard.ts" — that rationale is now stale twice over; cc-safety-net is the pi bash guard.
• The audit-trail value is partially covered by cc-safety-net's per-session logs (~/.cc-safety-net/logs/<session_id>.jsonl, persisted via named volume).

Salvageable idea not covered elsewhere: an observe-only write/edit audit log (cc-safety-net only sees Bash, not file-edit tools). If wanted, re-scope as a slim fresh PR on the new baseline: engine pin + hooks.yaml + log helper only, no vendored guards pack.

Branch feat/pi-yaml-hooks left intact for reference.