fix(child-session): align inherited tools with blocked package provenance

[JS-banana]

Problem

Fixes #483. Fixes #493.

With pi-intercom active in the parent, Direct Subagents and Workflow children inherit its tool names even though child resource loading excludes the package. Startup then fails before the first model turn.

This builds on #494 and retains naivezip's original commit/attribution. It incorporates the requested provenance and caller-test changes in a separate reviewable PR, rebased onto main at 5bf2fe2. The original PR remains untouched.

Value

Restore delegation while preserving the parent-only package boundary and unrelated third-party tools, including ordinary tools also named intercom.

Approach

• Use Pi's ToolInfo provenance and required getAllTools() at both production callers; remove the partial descriptor, optional metadata path, and array shorthand.
• Share the loaded-resource/package policy between child resources and inherited tools, respecting origin and scope. Resolve local sources through Pi's scoped getInstalledPath(): a nested single-file extension must be checked as a file so its owning manifest can be found above its containing directory.
• Propagate unverifiable identity errors instead of guessing from path substrings. Preserve offline handling of configured but unloaded packages and the existing OpenPI tool classification guard.
• Extend the existing real Pi fixture coverage for npm, Git, local directories, nested single files, unrelated same-name tools, and malformed/missing provenance. Exercise ordinary Direct spawn, typed Direct spawn, and Workflow agent() using actual parent package metadata and the existing child-session injection seams.

Validation

On the final rebased head, Node 22.23.1, Bun 1.3.14, Pi SDK 0.85.1:

• bun run check: passed, including Web build, formatting, lint, and type checks.
• bun run test: Node 1527 passed / 1 skipped; Vitest 130 passed across 9 files.
• git diff --check: passed.
• Red/green verification: the extended real-package inheritance regression fails against fix(child-session): dynamically exclude blocked package tools from child inheritance (#483) #494 at 88531a1 and passes after this correction.

Tests execute real package loading and shared child preflight; caller tests inject model/session responses. No live provider generation or installed interactive Pi acceptance is claimed. Existing bundle-size and jsdom scroll warnings remain.

Impact

• User-visible: delegation can start with a blocked package active in the parent.
• Model-visible tools: inherit only eligible active parent tools; role restrictions can only narrow them. The parent tool surface remains intact.
• Runtime: retain child package isolation and preflight; missing or unverifiable inherited provenance fails explicitly.
• Configuration/persistence: no schema or user-settings changes.
• Compatibility: uses the existing Pi >=0.85.1 tool metadata API; no new dependencies.

[tt-a1i]

Reviewed 48bc587 after current-main integration. Standards: no remaining actionable blocker identified. Spec: Authoritative Pi tool provenance and one shared blocked-package policy fail closed across Direct and Workflow child acquisition. No P0/P1 found. This supersedes findings against older implementations where stated; merge remains conditional on current required CI and branch protection.

[tt-a1i]

仅为现有测试 fixture 提供新增的 Pi provenance 参数，无运行时策略变化。 bun run check 已通过；完整测试已执行或正在串行验证，本机部分测试存在资源竞争超时，最终状态以最新 CI 为准。未发现 P0/P1。此账户推送了修复，仍需另一位维护者满足最后一次推送后的独立批准。