feat(runtime): track user-level Pi configuration with the provider key templated

Mirrors ~/.pi/agent/ as the authoritative copy. models.json becomes
models.json.template with ${ZENMUX_API_KEY} substituted; the real value stays
in secrets/zenmux.env, which is untracked and enforced by the pre-commit guard.

Excluded with rationale: auth.json, trust.json, models-store.json, sessions/,
herdr-agent-state.ts (installer-managed, overwritten on reinstall) and the
third-party skills under ~/.agents/skills.

Recorded during migration: the configured fallback model zenmux/x-ai/grok-4.6 is
absent from models.json, so pi falls back to an undeclared custom model id with
no context window, cost table or thinkingLevelMap. Fixing that is a behaviour
change and is deferred rather than folded into this zero-change migration.

secrets/zenmux.env.example

@@ -0,0 +1,6 @@
+# Copy to secrets/zenmux.env (mode 0600) and fill in the real value.
+# Consumed by scripts/deploy-runtime.sh when rendering
+# runtime/agent/models.json.template -> ~/.pi/agent/models.json
+#
+# Obtain from https://zenmux.ai/ account settings.
+ZENMUX_API_KEY=<REDACTED>