feat(egress-gate): add attested Pi prompt admission

[johnnygreco]

Summary

Add an attested rendered-prompt admission path for managed Pi sandboxes while preserving the existing generic HTTP-only Egress Gate mode.

This depends on the reviewed fork branches:

• Pi: https://github.com/johnnygreco/pi/tree/openshell/pi-egress-admission
• OpenShell: https://github.com/johnnygreco/OpenShell/tree/openshell/pi-egress-admission

Changes

• add a strict versioned Pi admission adapter and OpenAI Chat Completions request adapter
• keep Pi runtime-agnostic: the fork adds only the general-purpose pre-append hook, while this project owns the OpenShell-specific extension loaded through Pi's standard --extension option
• issue short-lived, one-shot Ed25519 receipts bound to the rendered prompt, sandbox, policy, harness version, middleware, and provider target
• verify and strip receipts at egress, then rerun Gates against the actual HTTP request
• add the OpenShell agent-conversation protobuf surface and generated Python bindings
• expose managed receipt enforcement through the service and CLI while retaining explicit unmanaged HTTP-only mode
• document and test denial-before-history, redaction, replay rejection, unsupported continuations, malformed inputs, and the example flow

Security boundary

The receipt attests the latest rendered prompt. It does not attest the complete conversation/provider payload or authenticate which same-sandbox process called the loopback bridge. Those limits are explicit; unsupported automatic continuations fail closed, and Egress Gate evaluates the actual outgoing HTTP request before forwarding.

Testing

• make check — 338 passed; formatting, lint, type/build/import checks, and dependency audit passed
• independent security, integration, and quality reviews — clean
• protocol file compared byte-for-byte with the OpenShell fork

Related issue

None. This is research integration work coordinated across the linked forks.