v0.1.29

Added

• A Pi stage receives pinned skills and commands; a pinned subagent warns and is skipped, since Pi
  ships none. (#142)
• A Pi stage writes a durable session under the run's scratch tree, resumable within the stage and
  reaped with the worktree. (#140)
• A container-isolated Pi stage enforces the pre-execution tool gate and can ask a structured
  question. (#137)
• A Pi stage can hand back a document from its dahrk_stage_complete tool, emitted as the stage's
  artifact. (#130)
• A container-isolated Pi stage reports its real dollar cost and runs on the model the stage asks
  for. (#139)

Changed

• A container-isolated Pi stage refuses outright when it lacks a security-critical capability, and
  emits capability-degraded for a non-critical gap. (#143)
• A Pi interactive stage receives its instruction as a system prompt, matching the Claude runtime;
  batch stages are unchanged. (#132)

Fixed

• An embedded Pi stage records a normal blocked deny when its own gate stops a confinement breach,
  instead of hard-failing. (#138)
• A Pi tool observation carries the tool's output in the trace. (#136)
• A Pi stage stops at the same DAHRK_MAX_TURNS ceiling Claude enforces, with the same terminal
  state and failure classification. (#131)