v0.3.3

Support Pi 0.82.1 in the bounded local Spark helper (#295)

## Summary

- migrate only the bounded physical-host Pi helper from exact
`@earendil-works/pi-coding-agent` 0.80.10 to exact 0.82.1
- enforce Pi 0.82.1's exact Node `>=22.19.0` engine contract inside the
same bounded process before Pi's entrypoint loads
- preserve exact Spark model, one-attempt, one-file, OAuth, settings,
timeout/output, process-group cleanup, and independent-review boundaries
- accept normal owner-managed provider cache and read-only settings
permissions on the explicitly trusted host, while rejecting unsafe cache
filesystem objects
- leave the separate fresh-Orb recipe pinned to 0.80.10

## Audit evidence

- registry and v0.82.1 source agree on package name, version, bin, and
Node engine
- all fixed CLI flags remain supported in published Pi 0.82.1
- published Pi 0.82.1 reached its entrypoint through the exact guard
under Node 22.19.0
- physical-host preflight confirmed exact Pi 0.82.1, compatible Node
25.9.0, all required flags, owner-managed OAuth metadata, bounded
settings, and normal generated cache state without exposing credential
contents

## Physical OAuth smoke

- one exact owner-authorized inference attempt on the trusted physical
host; no retry or fallback
- exact requested model `openai-codex/gpt-5.3-codex-spark`,
owner-managed OAuth, fixed no-tools/session/context argv, two-minute
bound, empty stderr
- helper returned `replacement_applied_untrusted` for exactly one test
file
- complete model diff contained the intended one-line normal-cache
fixture plus a missing final newline; exact-file gofmt corrected only
that formatting defect
- physical-host package verification encountered three existing PID
timing-fixture failures; no second provider attempt or semantic repair
ran
- coordinator reproduced the exact final line in the Orb and
independently passed the package once, five consecutive package runs,
race mode, scripts, formatting, and diff checks

## Validation

- `go test ./skills/amux-pi/experimental/pi-spark-local -count=1`
- `go test ./skills/amux-pi/experimental/pi-spark-local -count=5`
- `go test -race ./skills/amux-pi/experimental/pi-spark-local -count=1`
- `go test ./scripts -count=1`
- `go vet ./...`
- process-local signing-disabled `go test ./...` because the Orb's SSH
signing buffer was unavailable
- `git diff --check`
- published-package Node 22.19.0 guard/CLI smoke without inference

Closes #293