feat(extensions/pi): keybindings symlink + settings template + AWS/pi probes

Round out the pi bring-up story so a fresh machine can reach a working
pi+mempalace install with just `git clone && ./install.sh`:

- extensions/pi/keybindings.json: generic mosh/tmux newline fix
  (shift+enter, ctrl+j, alt+j). Safe on any machine — not
  region/account-specific. Symlinked into ~/.pi/agent/.
- extensions/pi/settings.example.json: template for `settings.json`
  so pi can start without --provider/--model. NOT symlinked — pi
  rewrites settings.json at runtime (lastChangelogVersion bumps),
  which would dirty the repo. Installer prints the cp + edit hint.
- install.sh: new install_pi_keybindings + uninstall mirror; new
  check_pi_settings probe (warns if settings.json missing); new
  check_aws_env probe (warns if AWS_PROFILE/AWS_REGION unset and
  settings.json selects amazon-bedrock). All new steps gated on
  pi being installed (~/.pi/agent/extensions/ exists).
- extensions/pi/README.md: documents keybindings rationale,
  settings bootstrap, and the recommended ~/.config/pi/.env +
  ~/.oh-my-zsh/custom/pi-env.zsh env layout (paired with the
  myconfigs commit 884e329 that split AWS vars out of
  ~/.config/opencode/.env).

Verified on tor-ms22: full install → uninstall → reinstall cycle,
new shell loads AWS_PROFILE/AWS_REGION from the new pi-env.zsh hook.

Works on macOS and Linux (plain ln -s, POSIX bash).

extensions/pi/README.md

@@ -73,17 +73,71 @@ If you ever need to re-loosen the schema for debugging, fall back to
 the `Type.Object({}, { additionalProperties: true })` default only for
 that specific tool, not globally.
 
+## Keybindings (mosh/tmux newline fix)
+
+`keybindings.json` is symlinked so edits flow through git. Default:
+
+```json
+{
+  "tui.input.newLine": ["shift+enter", "ctrl+j", "alt+j"]
+}
+```
+
+Rationale: when pi runs over `kitty → mosh → tmux`, shift+enter doesn't
+forward cleanly (mosh uses vt220-ish emulation, no kitty-keyboard-protocol
+or csi-u extended keys). `ctrl+j` and `alt+j` pass through as plain
+control/meta bytes and give you reliable newline insertion.
+
+## Settings template (start pi without `--model`)
+
+`settings.example.json` is a template — **not symlinked**. pi rewrites
+its `settings.json` at runtime (`lastChangelogVersion` bumps on upgrade),
+which would dirty a symlinked repo file. Instead, bootstrap with:
+
+```bash
+cp /path/to/mempalace-toolkit/extensions/pi/settings.example.json \
+   ~/.pi/agent/settings.json
+$EDITOR ~/.pi/agent/settings.json
+```
+
+The Bedrock inference-profile prefix on model IDs (`eu.`, `us.`) is
+**region-specific** and must match `AWS_REGION` in `~/.config/pi/.env`.
+For a bare Anthropic provider (non-Bedrock) drop the prefix entirely
+and use `anthropic:claude-...`. Run `pi --list-models` to confirm what
+your credentials can actually invoke.
+
+`install.sh` warns (non-fatal) if `settings.json` is missing.
+
+## Environment setup
+
+pi with `defaultProvider=amazon-bedrock` needs `AWS_PROFILE` and
+`AWS_REGION` exported into the shell that launches it. Recommended
+layout (matches the tor-ms22 dotfiles pattern):
+
+```
+~/.config/pi/.env               ← AWS_PROFILE=..., AWS_REGION=...
+                                  (git-crypt encrypted in dotfiles repo)
+~/.oh-my-zsh/custom/pi-env.zsh  ← set -a; source ~/.config/pi/.env; set +a
+```
+
+Historical note: these vars used to live under a `# Environment variables
+for pi` block inside `~/.config/opencode/.env`. Split out 2026-05-05 so
+each tool owns its own env file. `install.sh` runs a `check_aws_env`
+probe that warns if the vars are missing and points back here.
+
 ## File layout
 
 ```
 mempalace-toolkit/
 └── extensions/
     └── pi/
-        ├── README.md          ← this file
-        └── mempalace.ts       ← symlinked into ~/.pi/agent/extensions/
+        ├── README.md               ← this file
+        ├── mempalace.ts            ← symlinked into ~/.pi/agent/extensions/
+        ├── keybindings.json        ← symlinked into ~/.pi/agent/
+        └── settings.example.json   ← template; copy + edit into ~/.pi/agent/
 ```
 
 `install.sh` detects pi by probing for `~/.pi/agent/extensions/` and
-only creates the symlink when that directory exists. On machines
-without pi the file stays dormant in the repo. Re-runs are idempotent
-(same pattern as `bin/` and `SKILL.md`).
+only creates symlinks when that directory exists. On machines without
+pi the files stay dormant in the repo. Re-runs are idempotent (same
+pattern as `bin/` and `SKILL.md`).