chore: update dotfiles with new tool configs and pi settings

- Add configs for goose, herdr, ostt, fabric, zero, gnupg
- Restructure pi models.json (dupont, obelix, bianca, cloudflare)
- Update pi settings with new provider lineup, subagent overrides
- Add pi permission system, search config
- Add desktop entries (RampClient, terminal, tmux)
- Add tmux-open script, rename battery.sh -> battery
- Refactor fish config (simplify conditionals, fix nvim aliases)
- Switch worktrunk commit command from opencode to pi
- Update mise.toml with new tool symlinks
- Fix mise auth.json path reference

config/pi/agent/extensions/pi-permission-system/config.json

@@ -0,0 +1,24 @@
+{
+  "permission": {
+    "*": "ask",
+    "path": {
+      "./*": "allow",
+      "./.*": "allow",
+      "~/.ssh/*": "deny",
+      "*.env": "deny",
+      "*.env.*": "deny",
+      "*.env.example": "allow"
+    },
+    "bash": {
+      "*": "ask",
+      "rm -rf *": "deny",
+      "sudo *": "ask"
+    },
+    "external_directory": {
+        "*": "deny"
+    }
+  },
+  "debugLog": false,
+  "permissionReviewLog": true,
+  "yoloMode": true
+}