feat(trace): parse Pi coding sessions - #3547

Summary

Implements the provider/parser slice of spec issue-3520:

• copies the hook-reported Pi JSONL through a temporary file and atomically publishes it to Trace state;
• prevents pre-push from parsing a stale Pi copy after a failed refresh without changing existing-provider fallback behavior;
• validates Pi JSONL v3, follows the last persisted session-tree branch, and rejects duplicate IDs, cycles, selected orphans, invalid headers, and malformed interior lines;
• retains valid native and unknown selected entries while excluding Chainloop tree markers;
• maps deterministic model, token, cost, tool, conversation, timing, warning, and raw-session evidence; and
• ignores invalid usage values without making the resulting evidence uncraftable.

This PR implements R-006, R-007, and the provider-copy portion of R-005. It intentionally does not register Pi or add extension/hooks/CLI flags; those are the next implementation slice.

Compatibility and safety

• trace.ErrSessionDataNotFresh is opt-in. Existing providers keep their current behavior of attempting their previous copy after an ordinary refresh error.
• Pi requires the transcript path reported by its future extension and does not guess from the working directory.
• Copy and parse errors omit local transcript paths.
• No control-plane API, protobuf, evidence-schema, provider registry, or CLI changes are included.

Verification

• env -u CHAINLOOP_TOKEN -u CHAINLOOP_ORGANIZATION go test ./app/cli/...
• go test -race ./app/cli/internal/trace/pi ./app/cli/pkg/action
• parsed a live persisted Pi JSONL v3 session with the new provider
• git diff --check

Refs #3520

AI assistance

pi assisted with implementation and review. The commit carries an Assisted-by: pi trailer.