Adds a guardrails submodule option to coding.agents.pi that:
- Generates ~/.pi/agent/extensions/guardrails.json when enabled
- Automatically injects @aliou/pi-guardrails package into settings.packages
- Provides structured options for policies, pathAccess, and permissionGate
The module generates the JSON config that pi-guardrails reads for
its security hooks (policies, permission-gate, path-access).
Limitations documented in option descriptions:
- Path access checks are lexical (not symlink-safe)
- Local project guardrails.json can override global rule IDs
The previous jq filter grabbed the first non-stable release by creation date,
which incorrectly returned 1.123.38 instead of the latest stable 2.18.5.
Now query the 'stable' tag directly and extract version from its
target_commitish (e.g., 'release/2.18.5' -> '2.18.5'), ensuring we always
get the actual latest stable version.
Also bump version from 2.17.8 to 2.18.5 with updated hashes.
- Remove --pure from nix-shell shebang to allow network access
- Add --flake --system x86_64-linux for proper flake evaluation
- Navigate to nixpkgs root before running nix-update
- Also bump version 2.17.5 -> 2.17.8
m3ta-chiron
