Allow ExecutionPlan at policy layer and add visible Pi approval/run UI

[mmprotest]

Motivation

• Prevent the bridge from blocking on internal, non-mutating planning operations by classifying ExecutionPlan as ALLOW at the permission-policy layer.
• Make interactive Pi visible when Villani starts, runs, awaits approval, is denied, aborts, or completes so users see progress and pending approvals.
• Add regression tests to prevent regressions around plan approvals and Pi approval visibility.

Description

• Permission policy: PermissionEngine.evaluate_with_reason now explicitly returns ALLOW for ExecutionPlan (after deny precedence), and ExecutionPlan(*) is added to the default Runner allowlist so planning is treated as internal/read-only.
• Runtime routing: ensure_project_memory_and_plan in state_runtime.py now consults runner.permissions.evaluate_with_reason("ExecutionPlan", ...) and emits a policy_decision event; ALLOW auto-approves, DENY aborts, otherwise falls back to the existing approval flow (no special-casing in the Pi bridge).
• Pi extension UI: integrations/pi-villani/src/index.ts was updated to maintain persistent visible state via helper functions (setVillaniStatus, setVillaniWidget, clearVillaniUi, showFinalRunMessage) and to update status during startup, model-proxy start, runtime start, running, awaiting approval, denial, abort, and final completion/failure. Approval handling now sets a visible widget/message before invoking confirmation and clears/updates it after the decision.
• Tests: added Python tests to assert ExecutionPlan is allowed without invoking approval callback and that Write/Patch/Bash still require approval; added bridge integration tests to ensure no approval_required is emitted for ExecutionPlan; updated TypeScript extension tests to assert visible status/widget updates before and after approvals and on lifecycle events.

Testing

• Ran Python unit/integration suites: python -m pytest -q tests/integrations/test_pi_bridge.py tests/test_runner_approvals.py tests/test_auto_approve.py tests/test_state_runtime.py tests/test_permissions.py — all tests passed (77 passed, 1 skipped).
• Ran the Pi extension TypeScript tests: cd integrations/pi-villani && npm test — extension test suite passed (all subtests OK).
• Built the TypeScript package: cd integrations/pi-villani && npm run build — build succeeded.
• Manual pi install . was attempted but failed in this environment because the pi command is not available (expected environment limitation).

---

Codex Task