Update Pi peer dependencies: npm audit reports 7 high vulnerabilities

## Summary

The current `pi-ast-grep` lockfile installs `@earendil-works/pi-coding-agent@0.78.1`. A clean `npm audit` reports 7 high-severity vulnerable dependency entries, including a public Pi extension-approval advisory and multiple vulnerable networking/parser packages.

## Environment

- pi-ast-grep: `main` at `4a7d1beee684d96a6890e5fc55710bb63fecca85`
- OS: Linux 6.8, x86_64
- npm/Node runtime used for audit: Node `v20.20.2`
- Declared package engine: Node `>=20.0.0`

## Reproduction

```bash
git clone https://github.com/code-yeongyu/pi-ast-grep.git
cd pi-ast-grep
npm install
npm audit
```

## Expected Behavior

The extension should depend on a maintained Pi runtime line without known high-severity advisories, and its declared Node engine should match the selected Pi packages.

## Actual Behavior

`npm audit --json` exits 1 and reports:

```json
{
"info": 0,
"low": 0,
"moderate": 0,
"high": 7,
"critical": 0,
"total": 7
}
```

Affected entries include:

- Direct peer `@earendil-works/pi-coding-agent`
- [GHSA-mqxh-6gq7-558m](https://github.com/advisories/GHSA-mqxh-6gq7-558m): project-local extensions loaded without approval for versions `<0.79.0`
- `undici@8.3.x/8.4.x`
- TLS validation bypass, WebSocket denial of service, header injection, and response queue poisoning advisories
- `ws`
- memory disclosure and memory exhaustion advisories
- `postcss`
- source map path traversal/file disclosure
- `protobufjs`
- denial of service and property-shadowing advisories
- `vite` and `brace-expansion`
- path/UNC handling and denial-of-service advisories

The lockfile pins `@earendil-works/pi-coding-agent@0.78.1`. npm reports `0.82.1` as the available dependency remediation, marked as a semver-major change.

## Evidence

`package.json` currently declares:

```json
{
"peerDependencies": {
"@earendil-works/pi-ai": "^0.78.1",
"@earendil-works/pi-coding-agent": "^0.78.1",
"@earendil-works/pi-tui": "^0.78.1"
},
"engines": {
"node": ">=20.0.0"
}
}
```

The repository has Issues enabled and currently has no existing issues; searches for Pi dependency updates, undici, Node engines, and npm audit found no duplicate.

## Root Cause

The extension remains pinned to the Pi 0.78 dependency family and its corresponding transitive lockfile, predating the published security fixes. Because npm installs peer dependencies, consumers receive the vulnerable runtime subtree even when the host Senpi installation itself carries newer dependencies.

## Proposed Fix

- Upgrade the Pi peer dependency family to a current mutually compatible release, starting with `0.82.1`.
- Regenerate `package-lock.json`.
- Update the declared Node engine if required by the upgraded Pi packages.
- Run typecheck, unit tests, integration tests, and a real Senpi extension load.
- Add an audit or dependency-policy gate for high/critical production dependency advisories.

## Verification Plan

- `npm install`
- `npm audit --omit=dev` with no high or critical production findings
- `npm run check`
- `npm test`
- `npm run test:integration`
- Install through `senpi install git:github.com/code-yeongyu/pi-ast-grep` and execute an `ast_grep_search` call.

---
This issue or PR was generated by LazyCodex.
Tag: lazycodex-generated

Start with package.json and package-lock.json, checking the Pi peer dependency family and Node engine declaration before running npm install and npm audit --omit=dev. Verify the dependency update with npm run check, npm test, npm run test:integration, and the documented Senpi extension load and ast_grep_search call; done means no high or critical production findings and all checks pass.

Written by the indexing model from the issue text.