fix(extension): align and cover the Pi contract

[benvinegar]

Summary

• add a fake Pi registration/context harness around the shipped extension and exercise it through a real authenticated ephemeral Sideshow server
• invoke all seven tools, both lifecycle handlers, and the slash command across publishing, updates, exactly-once feedback, replies, listing, uploads, session reconstruction, automatic trace sync, auth failures, malformed responses, and unreachable-server behavior
• align the Pi schema with the current post contract by adding JSON/code surfaces and their fields
• require a real surface target for replies and support both canonical postId and legacy surfaceId response fields
• remove experimental trace publishing/uploading from Pi's agent-facing schemas and guidance while retaining invisible internal trace synchronization
• ratchet honest Node/Pi coverage floors

Coverage

• extensions/sideshow.js: 100% lines, 100% functions, 85.57% branches
• Node/Pi lines: 85.17% → 92.90%
• Node/Pi functions: 94.39% → 95.12% on Node 24 / 95.14% on Node 22
• Node/Pi branches: 83.40% → 83.70%+

The test passed repeated focused runs without temporary-directory, server, or environment leaks.

Validation

• npm run coverage on Node 24
• npm run coverage on Node 22 (isolated successful run; one earlier c8 child-process collection run was incomplete and passed on immediate isolated retry)
• npm run typecheck
• npm run lint
• npm run format:check
• npm run security:audit
• npm pack --dry-run --json
• independent review completed after three passes; final gate: PASS

This PR description was generated by Pi using GPT-5.2