Extract validated permission-gate extension from pipelines-debugger PoC
into a standalone Pi package with tests, type checking, and biome linting.

Co-authored-by: Cursor <cursoragent@cursor.com>