aws-sso: explicit local/remote mode (default local) and ntfy push for approvals

The mode cannot be inferred: Linux/Windows hosts can have a browser and an
always-on Mac can serve headless. /aws-sso local|remote, PI_AWS_SSO_MODE in
.env; a command-set mode wins; old mac/device names map. PI_AWS_SSO_NTFY
pushes the device link (tap to approve), a heads-up when a local login waits
>60 s, failures, and 'renewed'. Topic shown only as host + fingerprint.
Unprompted logins back off 30 min doubling to 4 h; a run that stopped on an
expired session resumes after any later successful login.

AGENTS.md

@@ -26,7 +26,7 @@ extensions/
   mcp-loader.ts           # Generic MCP server loader + /mcp slash command
   task.ts                 # `task` tool — pi-task (isolated child, PASS/FAIL envelope, boundary diff) as a tool
   fork-gate.ts            # tool_call hook: block forks whose brief needs `task`; reason = the task(...) to make
-  aws-sso.ts              # /aws-sso: run `aws sso login` (host browser or device code) before the IdC session ends
+  aws-sso.ts              # /aws-sso: renew the AWS SSO session when it ends (local: host browser; remote: device code + ntfy push)
 test/                     # node --test 'test/**/*.test.mjs' — two-sided tests for the pure parts (classifier, root validation)
 install.sh                # Idempotent installer — symlinks extensions/ into ~/.pi/agent/extensions/
 package.json              # pi package manifest — enables `pi install /path` as an alternative