refactor: rebuild ForgeFlow as Pi-native governance

[BakerSean168]

Summary

• establish ForgeFlow as a Pi package on top of pi-subagents
• move reusable invariant policy into the Pi extension
• add trusted structured review and exact-head GitHub acceptance workflows
• make the existing verify CI job validate the Pi-native package before legacy Python checks

Migration boundary

Open SWE/LangGraph/Python runtime code is intentionally retained only until the Pi-native canary succeeds. This PR establishes the replacement execution boundary before destructive deletion.

Validation

• Pi-native Node tests: 21 passed
• legacy Python regression suite: 564 passed across four bounded batches
• Ruff: passed
• npm package dry-run contains only Pi-native extension/scripts/skill plus README/LICENSE
• pi-subagents workflow validator accepts both ForgeFlow workflows
• GitHub helper read-only smoke returned the expected fail-closed verdict on a merged PR