fix(spawn): harden abort/reset race handling, bump Pi to 0.84.1, clear security allowlist

[ofriw]

Note: This PR was generated by an AI agent. If you'd like to talk with other humans, drop by our Discord!

---

What Changed

Spawn lifecycle hardening — Race conditions between signal aborts, reset invalidation, and prompt rejections are now handled deterministically via a shared abort-promise pattern (abortChildSession in state.ts). Previously, concurrent abort + reset could double-fire session.abort() or swallow real prompt errors; now the shared WeakMap<AgentSession, Promise<void>> ensures one abort per session, and non-AbortError prompt failures propagate even during abort races.

CI / compat testing overhaul —

• Removed the hardcoded Pi 0.82.0 floor-compat lane. Replaced with a latest-Pi-lane that dynamically resolves the current Pi release + its TypeBox peer from the npm registry.
• Added runNpmWithRetry() with exponential backoff for transient registry failures.
• New compat-fixture.mjs extracts shared compat utilities (createCompatCopy, prepareCompatCopy, resolveLatestPi, diagnostics).
• CI now uploads diagnostic artifacts on failure for both the packed-host and current-Pi lanes, plus a workflow_dispatch trigger.

Security audit cleanup — Emptied the audit-ci allowlist entirely. All previously suppressed advisories for brace-expansion and undici (pinned by Pi 0.82.0) are resolved by bumping to Pi 0.84.1 / TypeBox 1.3.7.

Renovate config added — .github/renovate.json pins Pi packages and TypeBox to exact versions.

Breaking Changes

None user-facing. The test-compat-floor.mjs script and test:compat:floor npm script are removed.

Why

• The spawn race fix closes edge cases where aborted children could leak or real errors could be silently swallowed during /reset or signal cancellation — important for correctness of child session lifecycle management.
• The compat test modernization ensures the extension is validated against the current Pi release rather than a stale 0.82.0 floor, catching upstream regressions earlier and more often.
• The empty allowlist enforces a clean security posture — no more suppressing known advisories.

Testing

• New abort-child-session.test.ts + 4 new race-condition tests in spawn.test.ts cover abort dedup, sync/async abort throws, and signal-vs-reset priority.
• runNpmWithRetry tested with fixture npm CLI simulating transient failures.
• Config invariant tests now assert empty allowlist + pinned Pi 0.84.1 / TypeBox 1.3.7.

---

Attached is an agent optimized description of the changes in this PR - AGENT_REVIEW.md