feat: scenarios for curator/memo-inbox/pi-grok, deploy and backup tooling

Scenarios
- memo-inbox: mirrored by copying; the live directory was not moved or modified
  and the service was not restarted. All four tracked files match byte for byte
  (pi-diff.sh reports SAME). Marked deploy = "mirror" so deploy-scenario.sh
  refuses --apply: applying a mirror would invert the direction of truth and
  could change a service in daily use.
- curator: target configuration, not yet deployed. .pi/SYSTEM.md replaces pi's
  coding-assistant prompt; durable role text is in .pi/APPEND_SYSTEM.md;
  profile.toml is the single source of truth for the launch contract.
- pi-grok: registered only. It is genuinely a coding agent, so the isolation
  baseline does not apply in full.

Corrections to the documentation, found by testing rather than by reading
- AGENTS.override.md does NOT block parent-directory context files; it only
  shadows its own directory. Verified: with an override file in the workspace, a
  marker in /tmp/AGENTS.md still reached the system prompt. The only effective
  switch is --no-context-files, so durable role text must live in
  .pi/APPEND_SYSTEM.md, which is a system-prompt file and unaffected by -nc.
  Verified end state: no coding-assistant framing, no pi-docs block, own
  identity and role text present, no parent pollution, only own skills/tools.
- PI_CODING_AGENT_DIR isolates settings/models/auth/trust/extensions/skills/
  prompts/themes under the agent directory -- stronger than the --no-* flags
  because it also repoints credentials -- but does NOT cover ~/.agents/skills.
  Measured: find-skills, modsearch and summarize still leak. So it complements
  --no-skills rather than replacing it.
- --append-system-prompt accepts a file path, which pi-grok relies on.
- cwd is what anchors .pi discovery: a probe that forgot cwd silently lost
  .pi/SYSTEM.md and kept the coding-assistant persona.

Tooling (all dry-run by default; none of them restarts a service)
- pi-diff.sh: compares tracked config against the live install in both
  directions, with a key-redacted comparison for models.json
- deploy-scenario.sh: installs a workspace and renders profile.toml into
  .pi/launch.json, then checks that every referenced path exists
- deploy-runtime.sh: renders models.json from its template, refusing placeholder
  or missing keys. Verified byte-identical to the live file
- pi-backup.sh / pi-restore.sh: archives outside the repo, sha256 manifest
  verified before any restore, live paths preserved rather than overwritten

Fixed while testing: pi-backup.sh compared the destination against the repo root
literally, so a relative --dest ./backups wrote credential archives into the work
tree. Now canonicalised with realpath; ./backups, an absolute in-repo path and
./docs/../backups are all refused.

docs/plans/2026-08-curator-agent-refactor.md

@@ -80,6 +80,7 @@ agent loop，于是 `AGENTS.md`/`SKILL.md` 大量篇幅在用散文对抗一个
 | P0-10 | `media_catalog.py:249-264,34,55` | `acquire` 成功后不清 `_cache`（TTL 300 s），此后最多 5 分钟查询把刚加入的作品报成 `not_found`。另：`Settings.catalog_cache_ttl_seconds`（默认 60）从未被 `MediaCatalog` 读取。 |
 | P0-11 | `pi_agent.py:41-54` | 未传 `--no-extensions`/`--no-skills`/`--no-themes`，用户级 `herdr-agent-state.ts`(287 行)、`pi-memo-trust.ts` 与 `~/.agents/skills/{find-skills,modsearch,summarize}` 泄入。实测 `PROBE_SKILLNAMES=["find-skills","modsearch","summarize"]`。`find-skills` 诱导 agent 安装更多 skill。 |
 | P0-12 | 全局 | **`SKILL.md` 从未生效**（`system-prompt.js:59,113` 的 `hasRead` 门禁）。`--skill`（`pi_agent.py:48`）是空操作。README:89-91 与 `deployment.zh-CN.md:467` 描述错误。 |
+| P0-14 | workspace 无 `-nc` | context file 从 cwd 的每一级父目录加载。`~/AGENTS.md` 或 `~/pi-workspaces/AGENTS.md` 一旦出现即污染两个场景，且 `AGENTS.override.md` **不能**阻断（已实测：override 存在时 `/tmp/AGENTS.md` 仍进入系统提示）。唯一有效开关是 `-nc`，因此长期职责必须移入 `.pi/APPEND_SYSTEM.md`。 |
 | P0-13 | 无 `.pi/SYSTEM.md` | Curator 跑在 pi 默认**编码助手**人格上（"reading files, executing commands, editing code"），并附带 pi 自身 README/docs/examples 的绝对路径与"读完并跟随交叉引用"指令 —— 对注入而言是现成路径。 |
 
 ### P1
@@ -128,10 +129,10 @@ Telegram ──► TelegramGateway（薄适配器）
           --no-builtin-tools                              │
           --no-extensions -e curator-tools.ts ────────────┘
           --no-skills --skill .pi/skills/{curator-core,video-arr,books-ingest}
-          --no-prompt-templates --no-themes --approve
+          --no-prompt-templates --no-themes --approve -nc
                   │
                   ├─ .pi/SYSTEM.md          策展人格（替换编码助手）
-                  ├─ AGENTS.override.md     持久职责 + 截断父目录上溯
+                  ├─ .pi/APPEND_SYSTEM.md   长期领域职责
                   └─ .pi/skills/*           按需加载的领域策略
 ```
 
@@ -197,7 +198,7 @@ Telegram ──► TelegramGateway（薄适配器）
 | # | 动作 | 修复 |
 |---|---|---|
 | 1 | 建 `.pi/SYSTEM.md`（规格见 §4） | P0-13 |
-| 2 | 建 `AGENTS.override.md` 截断父目录上溯 | F7 隐患 |
+| 2 | 加 `-nc`，长期职责移入 `.pi/APPEND_SYSTEM.md`，workspace 不留 `AGENTS.md`（`AGENTS.override.md` **不能**阻断父目录，已实测） | F7 隐患 |
 | 3 | `SKILL.md` 策略暂并入 AGENTS（阶段 3 拆回），删除空操作 `--skill` | P0-12 |
 | 4 | 加载隔离：`--no-extensions -e <abs>` `--no-skills` `--no-themes` | P0-11 |
 | 5 | `env=` 白名单 + `start_new_session=True` + `killpg` | P0-7 / P1-2 |
@@ -255,7 +256,7 @@ Telegram ──► TelegramGateway（薄适配器）
 5. 写操作策略引擎（§2 的五条） → 修 P0-2 / P0-4 / P0-5。
 6. `.pi/settings.json`：`compaction.keepRecentTokens` 调优，配合会话轮转。
 7. 观测：`message_update.usage` / `get_session_stats` → `control_events` → 修 P1-9。
-8. `AGENTS.override.md` / `SYSTEM.md` 定稿；skill 拆 `curator-core` /
+8. `.pi/SYSTEM.md` / `.pi/APPEND_SYSTEM.md` 定稿；skill 拆 `curator-core` /
    `video-arr` / `books-ingest`，按架构 §2.3 声明字段，**不依赖 `allowed-tools`
    frontmatter**（0.84.3 未消费） → 修 P1-6 / P1-7。