Draft: isolated Pi execution profile for local-model workflows

[BrettKinny]

Adds an initial Linux host sqrbx-agent implementation intended to let Pi operate on an independent project checkout through a hardened rootless Podman profile, with normal Squarebox Box behavior preserved.

Draft: this does not yet achieve a working, streamlined local-model Pi workflow. Do not merge as a validated security boundary.

Implemented surfaces:

• Independent Git session repositories with host-owned identity/reporting metadata, immutable image lookup, and retained workspace files.
• Podman profile with an unprivileged user, capability dropping, no-new-privileges, temporary home, read-only root, and no credential/runtime-socket mounts.
• Host-side Pi SDK adapter, explicit network selection, shell integration, deterministic tests, security documentation, ADR 0010, and CODEOWNERS.
• Gondolin is unimplemented and fails explicitly; no automatic fallback.

Confirmed blockers from integration review:

• Real pinned Pi SDK initialization produces zero active and registered tools: noTools: "all" suppresses the custom Bash tool. Mock tests missed this.
• Local custom models are looked up through the static SDK catalog instead of the configured model runtime. There is no streamlined endpoint setup.
• Podman preflight checks host.rootless and treats a remoteSocket.path as evidence of a remote service. Documented Podman output uses host.security.rootless and host.serviceIsRemote; a local installation can have a socket path.
• Bare invocation selects the unimplemented Gondolin backend, provider/model flags are mandatory, and the adapter replaces Pi's normal TUI with a basic readline loop.
• CLI launch/diff/discard do not use the session lock, and discard does not first verify/stop the owned backend. The lock helper also releases immediately for asynchronous callbacks. Concurrent guest mutation and cleanup need correction before security claims are justified.
• diff computes a patch but only prints the summary; resume is not implemented. Cleanup failures can still be followed by host inspection of a live workspace.

Validation performed:

• All 20 executable deterministic test scripts passed, including 21 agent assertions. Native PowerShell tests reported their existing skip because pwsh was unavailable.
• ShellCheck on the new shell scripts, actionlint, JSON parsing, and git diff --check passed.
• Exact Pi SDK dependencies installed with lifecycle scripts disabled; real session initialization succeeds, but the active-tool inspection above demonstrates why initialization alone is insufficient validation.
• No real Podman/container or local-model end-to-end run was completed: Podman was absent, local Docker daemon access was denied, and passwordless sudo was unavailable.

Recommended next step: compare a thin launcher around Pi's maintained Gondolin integration with a corrected Podman adapter, preserving the real Pi UI and host-owned local-model configuration. Acceptance should be one-time configuration followed by sqrbx-agent ., a real local-model tool call/edit/test cycle, blocked guest egress/host-path checks, and safe retained-workspace review/discard.

Repository settings and secrets are unchanged. SECURITY.md records recommendations for one approving review, latest-push approval, CODEOWNER review, resolved review threads, and retained no-bypass/status-check/release protections.