aws-sso: keep the Bedrock SSO session alive by running aws sso login before it ends

Like Claude Code's awsAuthRefresh: the user still approves each login.
mode mac runs it on the Docker host over SSH (own browser); mode device shows
the device code in pi for SSH/tmux use. Off by default (/aws-sso on).
Session start inferred from refresh-token changes; 8 h default, measured.

AGENTS.md

@@ -26,6 +26,7 @@ extensions/
   mcp-loader.ts           # Generic MCP server loader + /mcp slash command
   task.ts                 # `task` tool — pi-task (isolated child, PASS/FAIL envelope, boundary diff) as a tool
   fork-gate.ts            # tool_call hook: block forks whose brief needs `task`; reason = the task(...) to make
+  aws-sso.ts              # /aws-sso: run `aws sso login` (host browser or device code) before the IdC session ends
 test/                     # node --test 'test/**/*.test.mjs' — two-sided tests for the pure parts (classifier, root validation)
 install.sh                # Idempotent installer — symlinks extensions/ into ~/.pi/agent/extensions/
 package.json              # pi package manifest — enables `pi install /path` as an alternative