docs(changelog): v1.6.3 — pi 0.81.1→0.82.1

Pure pi version bump (variant-only rebuild). CI resolves pi@latest=0.82.1 at build. 0.82.0/0.82.1 audited: additive, no breaking changes to the extension execution API (pi-observational-memory) or pi-agent-core types (pi-fork).

CHANGELOG.md

@@ -15,6 +15,40 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 _Nothing yet — next release's changes will accrue here._
 
+## v1.6.3 — 2026-07-25
+
+Patch release. Headline: **pi `0.81.1` → `0.82.1`** (npm `latest`) — the first
+pi bump since v1.6.1.
+
+### Changed
+
+- **pi `0.81.1` → `0.82.1`.** CI resolves `pi@latest` at build time; latest is
+  now `0.82.1` (via `0.82.0`). pi is installed in the **variant** layer
+  (`Dockerfile.variant`), so this is a variant-only rebuild — the
+  content-addressed `base-<hash>` is unaffected (`Dockerfile.base`, `rootfs/`,
+  `entrypoint*.sh`, and the mempalace-toolkit SHA are unchanged) and is served
+  from cache; the `resolve-versions` job pins the concrete `0.82.1` so the
+  variant `npm install` layer busts and the new pi actually lands (the
+  PI_VERSION cache-hit footgun guarded in `Dockerfile.variant`). Both `0.82.0`
+  and `0.82.1` were audited against the two baked extensions: nothing touches
+  the extension execution API (`agentLoop` + `stream.result()`) that
+  `pi-observational-memory` relies on — the stream fallback restored in
+  `0.81.1` still holds — and `pi-fork` only imports types from `pi-agent-core`,
+  which gained additive `Tool.constrainedSampling` / capability flags with no
+  breaking changes. The Node engine requirement is unchanged (`>=22.19.0`; the
+  base ships `22.23.1`). Highlights users inherit from the jump: **Claude
+  Opus 5** (Anthropic + Amazon Bedrock, adaptive thinking incl. `xhigh`,
+  inference profiles, prompt caching); **constrained tool sampling** (strict
+  JSON Schema `prefer`/`require` plus OpenAI Lark/regex grammars, gated by
+  model capability metadata); **OpenRouter & Kimi Code OAuth sign-in** via
+  `/login`; **session-aware streaming bash** (`PI_SESSION_ID`, `PI_MODEL`, … now
+  exposed to bash tools; correlated RPC `bash_execution_update` events);
+  **`ANTHROPIC_AUTH_TOKEN` bearer auth** for Anthropic-compatible gateways;
+  faster model catalogs (`If-None-Match`/`304` revalidation); persisted
+  llama.cpp model catalogs; and a bundled **`protobufjs` 7.6.5** security bump
+  (GHSA-j3f2-48v5-ccww). See the [pi changelog][pi-changelog] for the full
+  list.
+
 ## v1.6.2 — 2026-07-23
 
 Patch release. **Completes the v1.6.1 studio publish.** CI-only change; the