feat(web): project Pi trust state in snapshots

[seekskyworld]

Problem

Implements the snapshot portion of #343. Web clients could not distinguish the active workspace trust state before invoking operations.

Value

The browser can show whether the current workspace is trusted without owning or persisting a second permission policy.

Approach

Read Pi SettingsManager trust state through the Web runtime, map it to bounded trusted/untrusted/unknown values, and include it in the existing runtime snapshot projection. Unbound or unreadable state fails closed to unknown.

Validation

• npx tsc --noEmit
• node --test --experimental-strip-types tests/web/protocol.test.ts tests/web/pi-adapter.test.ts tests/web/pi-runtime.test.ts (44 passed)
• git diff --check

Impact

• User-visible behavior: snapshot consumers receive trust status for display.
• Model-visible context/tools: none.
• Runtime/lifecycle: reads Pi-owned trust state only.
• Persisted config/data: none.
• Compatibility/risk: optional controller field preserves existing test doubles; approval actions remain a separate follow-up.

[tt-a1i]

请让给 #392

runtime.trust 来自 Pi isProjectTrusted()，缺了 fail-closed 成 unknown，方向对。但把 restricted/undecided 压成 untrusted，字段也不如 #392 完整，而且没有测试。

请关掉，改合 #392。Node 24 的 tests/web/cli.test.ts 红也请先分清是不是共享抖动。

[tt-a1i]

Exact-head review found no new P2+ in the narrow original projection; focused protocol/adapter/runtime tests passed 44/44. Relative to current main, however, the value is already covered by #442’s richer Pi-owned getProjectTrustStatus/trustInfo and GET /api/trust projection, including stored decision, restricted/unknown state and refresh-required facts. Recommend treating this proposal as superseded rather than adding a parallel reduced trust field. The branch also conflicts with main and has a historical Node 24 CLI smoke failure; the latter is not established as a regression from this diff. No merge or closure performed.

[tt-a1i]

Closing as superseded by the richer Pi-owned trust projection integrated in #442. Current main preserves stored decision, restricted/unknown state, resource provenance and refresh-required facts; adding this older parallel trust field would duplicate that source of truth. Thank you for the proposal and implementation. The useful unarchive work in #361 is being handled separately with author attribution.