feat: scenarios for curator/memo-inbox/pi-grok, deploy and backup tooling

Scenarios
- memo-inbox: mirrored by copying; the live directory was not moved or modified
  and the service was not restarted. All four tracked files match byte for byte
  (pi-diff.sh reports SAME). Marked deploy = "mirror" so deploy-scenario.sh
  refuses --apply: applying a mirror would invert the direction of truth and
  could change a service in daily use.
- curator: target configuration, not yet deployed. .pi/SYSTEM.md replaces pi's
  coding-assistant prompt; durable role text is in .pi/APPEND_SYSTEM.md;
  profile.toml is the single source of truth for the launch contract.
- pi-grok: registered only. It is genuinely a coding agent, so the isolation
  baseline does not apply in full.

Corrections to the documentation, found by testing rather than by reading
- AGENTS.override.md does NOT block parent-directory context files; it only
  shadows its own directory. Verified: with an override file in the workspace, a
  marker in /tmp/AGENTS.md still reached the system prompt. The only effective
  switch is --no-context-files, so durable role text must live in
  .pi/APPEND_SYSTEM.md, which is a system-prompt file and unaffected by -nc.
  Verified end state: no coding-assistant framing, no pi-docs block, own
  identity and role text present, no parent pollution, only own skills/tools.
- PI_CODING_AGENT_DIR isolates settings/models/auth/trust/extensions/skills/
  prompts/themes under the agent directory -- stronger than the --no-* flags
  because it also repoints credentials -- but does NOT cover ~/.agents/skills.
  Measured: find-skills, modsearch and summarize still leak. So it complements
  --no-skills rather than replacing it.
- --append-system-prompt accepts a file path, which pi-grok relies on.
- cwd is what anchors .pi discovery: a probe that forgot cwd silently lost
  .pi/SYSTEM.md and kept the coding-assistant persona.

Tooling (all dry-run by default; none of them restarts a service)
- pi-diff.sh: compares tracked config against the live install in both
  directions, with a key-redacted comparison for models.json
- deploy-scenario.sh: installs a workspace and renders profile.toml into
  .pi/launch.json, then checks that every referenced path exists
- deploy-runtime.sh: renders models.json from its template, refusing placeholder
  or missing keys. Verified byte-identical to the live file
- pi-backup.sh / pi-restore.sh: archives outside the repo, sha256 manifest
  verified before any restore, live paths preserved rather than overwritten

Fixed while testing: pi-backup.sh compared the destination against the repo root
literally, so a relative --dest ./backups wrote credential archives into the work
tree. Now canonicalised with realpath; ./backups, an absolute in-repo path and
./docs/../backups are all refused.

scenarios/pi-grok/profile.toml

@@ -0,0 +1,58 @@
+# pi-grok — Pi scenario profile
+#
+# STATUS: registered only. Nothing is tracked or deployed for this scenario yet;
+# this file exists so that pi-diff.sh and the scenario index know it is here and
+# why it is intentionally different from the others.
+
+[scenario]
+name        = "pi-grok"
+description = "Interactive Grok 4.6 coding agent for user programming projects."
+workspace   = "/home/claw/pi-workspaces/pi-grok"
+session_dir = "/home/claw/pi-workspaces/pi-grok/sessions"
+service     = ""            # no service: launched by hand via bin/pi-grok
+launcher    = "/home/claw/pi-workspaces/pi-grok/bin/pi-grok"
+tracked     = false
+
+[model]
+provider = "zenmux"
+primary  = "x-ai/grok-4.6"
+thinking = "high"
+
+[isolation]
+# This scenario uses a fundamentally different -- and in one respect stronger --
+# approach than curator and memo-inbox: a dedicated agent directory.
+#
+#   export PI_CODING_AGENT_DIR="$PI_GROK_HOME/.pi-agent"
+#
+# That isolates settings.json, models.json, auth.json, trust.json, extensions/,
+# skills/, prompts/ and themes/ in one move, including the provider credential.
+# It is the only mechanism here that stops one scenario's auth.json from being
+# reachable by another's agent.
+#
+# Measured limitation: it does NOT cover ~/.agents/skills/, which is a separate
+# discovery root. find-skills, modsearch and summarize still load.
+# See docs/pi-runtime-notes.md section 10b.
+agent_dir_override = "/home/claw/pi-workspaces/pi-grok/.pi-agent"
+no_extensions      = false
+no_skills          = false   # gap: ~/.agents/skills still leaks
+no_builtin_tools   = false   # intentional -- see below
+no_context_files   = false
+
+[personality]
+# Durable role text is injected with --append-system-prompt pointing at a file,
+# which is immune to the parent-directory context walk and needs no project
+# trust. See docs/pi-runtime-notes.md section 10c.
+append_system_prompt = "/home/claw/pi-workspaces/pi-grok/AGENTS.md"
+system_prompt        = ""     # keeps pi's default coding-assistant prompt
+
+# NOTE ON SCOPE
+#
+# Unlike curator and memo-inbox, this genuinely *is* a coding agent. pi's default
+# coding-assistant system prompt and its built-in read/bash/edit/write tools are
+# appropriate here, so the isolation baseline in docs/isolation-baseline.md does
+# not apply in full. What still applies:
+#
+#   - the ~/.agents/skills leak is unwanted noise for any narrow task
+#   - there is no sandbox, so this agent has the full permissions of the user
+#
+# Bringing it under management is out of scope for the 2026-08 Curator refactor.