- switch @gotgenes/pi-permission-system from >=24.0.0 to ^24.0.0
- add pi.extensions entry pointing to packages/pi-permission-inner-cmd/src/index.ts - mark package private
- add pnpm workspace scaffold with shared TypeScript config - register an ai-bash-judge authorizer with pi-permission-system - log permission request details and deterministic policy verdicts - record review entries and defer to the next authorizer