fix(pi): resolve bundled Pi CLI from node_modules instead of PATH

Production bug: PiSubagentRunner spawned subagents via spawn("pi", ...)
which only works when the Pi CLI is on $PATH. This is true for
interactive Pi users who installed the global binary, but NOT for:
  - CI runners (Pi installed via bun install into node_modules)
  - e2e harness (resolves @earendil-works/pi-coding-agent in node_modules)
  - npm-only user installs without global symlink
  - npx/bunx users

The CI signature was unmistakable: on GitHub-hosted runners, Pi historian
tests waited exactly the full waitFor budget (15s, 30s, 90s, 300s — each
limit hit precisely) with ZERO HTTP requests reaching the mock provider.
The 'pi' spawn was silently failing because no such binary existed; the
subagent process died before any LLM call.

Fix: resolve @earendil-works/pi-coding-agent/dist/cli.js via
createRequire().resolve() rooted at this module, mirroring the pattern
the e2e harness uses (packages/e2e-tests/src/pi-runner/spawn.ts). When
resolved, spawn 'bun <cli.js>' so we don't need the bin symlink. Falls
back to 'pi' on PATH so interactive Pi CLI users are unaffected.

Verification:
  - 297/297 Pi unit tests pass
  - 4/4 affected Pi e2e tests pass locally in 11.84s (would have hit
    300s timeouts on CI before this fix)
  - Lint/typecheck/build clean