Fix Pi approval response deadlock, widget API, and bump runtime to 0.1.4

[mmprotest]

Motivation

• Eliminate a deadlock where rejected/throwing approval UI code could leave the Python bridge waiting indefinitely for an approval response.
• Make the approval handling fail-closed so UI/setup/confirm failures always produce a single denied response.
• Use the supported Pi widget API shape and surface minimal runtime-source diagnostics while keeping changes production-safe and minimal.

Description

• Ensure detached approval handlers are observed by calling handleApprovalRequired(...).catch(...) at the event boundary and deny any still-pending request on error.
• Rework handleApprovalRequired(...) so all UI operations occur inside a guarded path and the function always calls sendApprovalResponseIfPending(...) (which atomically deletes the pending id and responds) so each request_id receives exactly one response even on errors or aborts.
• Replace the Pi widget call to use the options object: ui.setWidget(key, lines, { placement: "aboveEditor" }) (preserves placement semantics).
• Add safe helpers safeWarn, safeInfo, safeSetVillaniStatus, and safeSetVillaniWidget so logging/UI warnings cannot block sending the approval response.
• Add reportRuntimeSource(...) to log whether a VILLANI_COMMAND override or cached/downloaded runtime is used (non-fatal diagnostics).
• Bump bundled runtime version in integrations/pi-villani/src/runtimeConfig.ts from 0.1.3 to 0.1.4 so a new packaged runtime will be requested instead of reusing a stale cached runtime.
• Extend integrations/pi-villani/src/extension.test.ts with regression tests that cover: confirmation-approve, confirmation-deny, status rendering failure, widget rendering failure, confirmation dialog failure, abort while pending, and duplicate-response prevention; the tests also validate the widget placement option and that only a single response is emitted per request.
• Files changed: integrations/pi-villani/src/index.ts, integrations/pi-villani/src/runtimeConfig.ts, and integrations/pi-villani/src/extension.test.ts.

Testing

• Ran cd integrations/pi-villani && npm ci which completed successfully (environment Node warnings about engines only).
• Ran cd integrations/pi-villani && npm run typecheck which completed successfully.
• Ran cd integrations/pi-villani && npm test which builds and runs the extension tests and produced all passing tests (TAP output: # pass 42).
• Ran repository Python integration tests pytest tests/integrations/test_pi_bridge.py which passed (20 passed).
• Attempted python -m PyInstaller --version to verify runtime packaging but PyInstaller is not installed locally (No module named PyInstaller), so the runtime packaging step could not be performed in this environment.

Note: a new release/tag and published runtime asset pi-villani-runtime-v0.1.4 must still be built and published so installed Pi users can download the updated standalone runtime; the code update only prepares the extension to request 0.1.4.

---

Codex Task