refactor(pi-devin): switch from npm+patch to vendored local fork

- Vendor the patched pi-devin@0.1.2 tree at apps/pi-devin/upstream/
  (third-party archive -> upstream_fork); git history replaces the patch
  layer as the change archive. Includes the devin-desktop identity fix
  and normalized catalog variant mapping from the previous patch.
- build-pi-package.sh now verifies source.sha256 against
  host-local-packages.json and npm-packs the vendored tree; drop the
  npm fetch + patch stage.
- install-pi-package.sh strips the npm-pack package/ prefix to match
  the playbook's unarchive behavior.
- Deployed to a100 via deploy_pi_devin_package (--limit a100, R2 then
  R3); remote verified to carry the fork source.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-devin",
-  "version": "0.2.1",
+  "version": "0.1.2",
   "description": "Pi provider for Devin Local models. Auth and catalog come from the local Devin CLI; Pi stays the harness.",
   "type": "module",
   "keywords": [
@@ -29,19 +29,17 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "node test-runner.mjs",
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.86.0",
-    "@earendil-works/pi-coding-agent": ">=0.86.0"
+    "@earendil-works/pi-ai": "*",
+    "@earendil-works/pi-coding-agent": "*"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "tsx": "^4.23.15",
     "typescript": "^5.9.2"
   },
   "engines": {
-    "node": ">=22.19.0"
+    "node": ">=18.0.0"
   }
 }