feat(pi): add local skills and file-backed prompts

[AnonymousMorris]

Intent

Validate and push the completed changes to the existing open PR #1 on feat/local-skills-and-prompts, then check CI and any other issues. The user explicitly chose temporary prompt files before pushing, superseding the earlier error-only approach. Nonempty composed appended prompts must be written to private per-session temporary files and passed to Pi as short absolute paths, so large prompts start and text equal to an existing filename stays literal. Preserve configured text before file contents, list order, startup-time file reads, and Ctrl-N rereading. Large literal system_prompt text also uses a temp file; preserve the separate system_prompt option existing explicit-file semantics and never delete user-owned source files. Create prompt files exclusively with owner-only permissions, handle short writes and creation/write/close failures, and clean resources on normal exit, cancellation, or failed startup before callbacks can interrupt cleanup. Keep the current session if replacement startup fails. Command inspection must not create files; custom cmd overrides and absent/empty prompts must not allocate them. Preserve raw unrelated startup errors. Do not restore obsolete prompt-size guesses or misleading E2BIG attribution. Preserve selectable local skills independently of discovery and the previous review fix that expands only leading home tilde while keeping other skill path characters literal. All prior pipeline fix commits are retained. Local verification passed all 11 E2E suites, including actual oversized prompts, permissions, cleanup, injected file failures, short writes, and session replacement. Real Pi startup checks confirmed successful large prompts and literal filename-like contents without making model requests. Review the final implementation, update the existing PR description to match it, push if checks pass, and check CI. Do not merge or create a replacement PR. Do not manually modify CHANGELOG.md or autogenerated files, and do not add agent co-authors to commits.

What Changed

• Add skill_paths for loading local skill files or directories independently of Pi skill discovery, with expansion limited to a leading ~/.
• Add append_system_prompt_filepath and compose literal prompt text before file contents in configured order, reading files at each session startup.
• Pass composed prompts and non-file system_prompt values through owner-only temporary files, while preserving explicit prompt files and cleaning temporary files after exit, cancellation, or failed startup.

Risk Assessment

✅ Low: The prompt-file lifecycle is well bounded, cleanup precedes callbacks, failures preserve the active session, and the source satisfies the stated prompt and skill-path requirements.

Testing

The supplied baseline reported all 11 E2E suites passing. This phase reran the three focused suites and performed three manual end-to-end checks through :AI, including an installed Pi 0.85.1 startup without a model request. The first observer attempt had an incorrect trailing-newline expectation in the temporary test harness; it was corrected and passed. Evidence logs record exact delivered sizes and hashes, mode 0600 permissions, ownership, error, and cleanup behavior. No screenshot was needed because this change affects backend process arguments and file lifecycle, not rendered UI. The worktree is clean and no test processes or temporary data remain.

Evidence: Observed :AI prompt delivery

Manual verification drove the public :AI command with a real subprocess observer.
session_started=true
skill_discovery_disabled=true
skill_args=#notes/SKILL.md | %notes/SKILL.md | skills/$HOME/SKILL.md | lua/ai/*.lua
append_arg_is_absolute_temp=true
append_mode=600
append_bytes=300110
append_sha256=01a8b82ccfa8d357651cfca650975e1612204d2fbf48a3ae77f2b1d6979e0024
literal_existing_filename_preserved=true
text_then_files_order_preserved=true
system_arg_is_absolute_temp=true
system_mode=600
system_bytes=300000
system_sha256=1c43f12b45fcc52d5410f25b355cac9c3472a9851ae058d28f5d75734ebd803a
temp_files_exist_while_session_alive=true
append_temp_exists_after_exit=false
system_temp_exists_after_exit=false
user_owned_sources_still_exist=true

Evidence: Real Pi startup without model request

Manual verification drove the public :AI command with the installed Pi executable and did not send a prompt or make a model request.
pi_version=0.85.1
large_literal_prompt_bytes=300066
prompt_argument_is_short_absolute_path=true
prompt_file_mode=600
process_alive_without_model_request=true
literal_filename_source_exists_before_stop=true
prompt_temp_exists_after_cancel=false
literal_filename_source_exists_after_cancel=true

Evidence: Prompt resource lifecycle

Manual verification exercised Pi backend startup, exit callbacks, command inspection, custom command overrides, empty prompts, and failed startup.
explicit_system_arg_is_user_file=true
user_system_file_exists_after_exit=true
temp_removed_before_exit_callback=true
command_inspection_temp_allocations=0
command_inspection_returns_literal_bytes=300000
custom_override_prompt_files=0
empty_prompt_flag_emitted=false
failed_start_error_is_raw_enoent=true
failed_start_temp_exists=false
failed_start_dispatch_callbacks=0

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• nvim --headless -u NONE -l tests/prompts_e2e.lua
• nvim --headless -u NONE -l tests/pi_command_e2e.lua
• nvim --headless -u NONE -l tests/config_e2e.lua
• nvim --headless -u NONE -l /dev/stdin with a subprocess observer for prompt bytes, hashes, permissions, ordering, literal paths, skills, and normal-exit cleanup
• nvim --headless -u NONE -l /dev/stdin against Pi 0.85.1 for actual large-prompt startup and cancellation cleanup without a model request
• nvim --headless -u NONE -l /dev/stdin for explicit system-file ownership, cleanup-before-callback ordering, inspection and override allocation behavior, empty prompts, and failed-start cleanup
• Post-test hygiene check with git status --short, targeted temporary-directory scan, and process scan

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.