test(review): pi canary, and run canaries with clone-local profiles

Adds the pi canary: a branch's .pi/extensions entry must not load during current-branch review or --target. Newer pi loads project extensions only in a trusted repo, so the test gives pi a private PI_CODING_AGENT_DIR whose trust store trusts the test repo (the real attack's setup, without touching ~/.pi); an invalid model makes pi exit after extension loading with no request. Fails against main's reviewer and passes with this branch on pi 0.87.1 and 0.99.2; on 0.70.2 the review fails closed with the update-pi message.

The review profile now lives in clone-local preferences, which the --target worktree shares, and Entire's settings are committed, so the target run is enabled and uses the invalid model or key too.