Initial commit: pi harness bring-up split out of mempalace-toolkit

Pi-generic config artifacts (no mempalace dependency):
- pi-env.zsh: shell loader sourcing ~/.config/pi/.env for AWS_PROFILE /
  AWS_REGION. POSIX-compatible (works in bash and zsh).
- keybindings.json: mosh/tmux newline bindings (shift+enter, ctrl+j, alt+j).
- settings.example.json: ~/.pi/agent/settings.json template so pi starts
  without --provider/--model. Region-specific (Bedrock inference-profile
  prefix).

install.sh mirrors mempalace-toolkit + opencode-toolkit patterns:
- require_pi_installed: hard exit 4 if ~/.pi/agent/ missing (cannot do
  anything useful; user must install pi first).
- symlink keybindings.json (safe: pi doesn't rewrite it).
- cp pi-env.zsh into ~/.oh-my-zsh/custom/ (portability over symlink,
  that dir is part of dotfiles backups). Print source snippet for bash
  / plain-zsh users.
- settings.example.json NOT installed \u2014 pi rewrites settings.json at
  runtime. check_pi_settings probe prints the cp command instead.
- check_aws_env: gated on settings.json selecting amazon-bedrock; silent
  for non-Bedrock providers or missing settings.
- All probes warn + return 0, never halt.
- Non-destructive: backup on symlink collision, cmp-based drift detection
  on the cp path, uninstall only removes copies whose content still
  matches repo.

Split rationale: opencode-devbox's mempalace opt-out (~300 MB saved)
wants pi available without mempalace. That dependency asymmetry is
cleanest when pi's own config lives in its own repo, same shape as
opencode-toolkit split out earlier today.

The pi\u2194mempalace MCP bridge (mempalace.ts) stays in mempalace-toolkit
where it belongs \u2014 it imports pi's ExtensionAPI but only exists to
bridge to the palace.

Verified on tor-ms22: fresh install \u2192 drift detect \u2192 adopt canonical \u2192
uninstall \u2192 reinstall \u2192 zsh -ic loads AWS vars. Bash fallback path also
tested via HOME=/tmp/fake SHELL=/bin/bash.

pi-env.zsh

@@ -0,0 +1,28 @@
+# Load pi coding-agent environment variables from ~/.config/pi/.env
+#
+# Canonical source: pi-toolkit/pi-env.zsh
+# Installed by pi-toolkit/install.sh via `cp` (not symlink) to keep
+# ~/.oh-my-zsh/custom/ portable across machines with different $HOME paths.
+# See pi-toolkit/README.md for the full story.
+#
+# Sources ~/.config/pi/.env (AWS_PROFILE, AWS_REGION, and any future
+# pi-scoped secrets) so pi's Bedrock provider works when spawned from any
+# shell. The .env file itself is shipped (git-crypt encrypted) from the
+# myconfigs dotfiles repo.
+#
+# `set -a` auto-exports every assignment in the sourced file, so plain
+# KEY=VALUE lines become exported env vars without needing `export` in .env.
+# Also works in bash (set -a and source are POSIX) — non-oh-my-zsh users
+# can source this file directly from ~/.bashrc or ~/.zshrc instead.
+#
+# Historical note: these vars used to live in ~/.config/opencode/.env
+# under a "# Environment variables for pi" block. Split out 2026-05-05
+# so each tool owns its own env file.
+
+_pi_env="${HOME}/.config/pi/.env"
+if [[ -r "${_pi_env}" ]]; then
+  set -a
+  source "${_pi_env}"
+  set +a
+fi
+unset _pi_env