fix(jobs): trust Pi project resources

[owainlewis]

Summary

• add explicit configured, unattended, and evaluator modes to the Pi runner
• pass --approve for unattended Pi jobs so project-local skills and settings load
• pass --no-approve for evaluators while leaving chat trust behavior unchanged

Why

Pi non-interactive runs do not show a project trust prompt. Under the default trust setting, jobs silently ignored project-local .agents/skills and .pi resources even though jobs run from the assistant repository.

Test plan

• cargo fmt --check
• git diff --check
• cargo test pi::tests (11 passed)
• cargo test --all-targets (331 unit tests plus integration and documentation tests passed)
• cargo clippy --all-targets -- -D warnings
• fresh independent review: Approve, no blocker or important findings

Risks

The deployed Pi executable must support --approve and --no-approve. Verified against installed Pi 0.80.10.

Related issue

None.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a2bb3bf659

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".