fix(pi): skip terminal permission-gate after island allow

[cat0825]

Summary

Fixes #286.

On pi, approving a dangerous bash command on the Dynamic Island still left a second Yes/No confirmation from a co-installed permission-gate.ts.

pi runs every extension tool_call handler; only { block: true } short-circuits. Island allow previously returned undefined, so permission-gate always re-prompted.

Changes

1. codeisland-pi.ts (v2 → v3)

• On explicit island allow, record event.toolCallId on globalThis.__codeislandAllowedToolCalls.
• Timeout / null response does not set the marker (terminal gate remains fallback).
• Fix the header comment that incorrectly claimed the extension "replaces" permission-gate.ts.

2. Installer version bump

• piExtensionVersion: v2 → v3 so repair reinstalls the fixed resource.

3. OMP version independence (regression guard)

• isOmpExtensionInstalled previously reused piExtensionVersion.
• A pi-only bump would false-flag healthy OMP installs as needing repair.
• Introduce independent ompExtensionVersion = "v2" and check it directly.

4. Tests

• Assert installed pi extension contains // version: v3 and __codeislandAllowedToolCalls.
• Leave OMP expectation at v2.

Coordination with user-managed permission-gate.ts

CodeIsland does not own permission-gate.ts (user extension). The intended companion check is:

const allowed = (globalThis as any).__codeislandAllowedToolCalls as Set<string> | undefined;
if (event.toolCallId && allowed?.has(event.toolCallId)) {
  allowed.delete(event.toolCallId);
  return undefined; // skip TUI prompt
}

Without that skip, the island still prompts once, but the terminal gate will still ask. With both sides, island Allow is sufficient for that tool call.

Degradation matrix

Scenario	Result
Island Allow	marker set → compatible gate skips TUI
Island Deny	{ block: true } (unchanged)
Island timeout / offline	no marker → terminal gate still prompts
No permission-gate.ts	behavior unchanged (island only)

Related

• Same dual-entry confirmation class as 修复（OMP）：终端原生 Ask 与 CodeIsland 并行回答 #264 (OMP Ask race), but for pi bash permissions.
• Add first-class pi coding-agent integration #196 / feat: add pi coding-agent integration #197 pi integration.

Verification

• Diff review of the three changed files.
• Local pi install already uses the same marker protocol with a companion permission-gate.ts skip.
• Installer/unit tests updated for v3 marker content.
• Full swift test not run in this environment (no local git checkout / Xcode build path for this fork via API-only push). Happy to iterate on CI.

# after local checkout
swift test --filter ConfigInstallerTests