feat(harness): integrate pi runtime into desktop app

[jonathanlab]

This sets up all the wiring needed to run Pi in the desktop app. We use a dummy conversation view, which is replaced by the ChatThread in the next PR.

it also alters taskmetadata to temporarily include these two:

ALTER TABLE `task_metadata` ADD `runtime` text;--> statement-breakpoint
ALTER TABLE `task_metadata` ADD `pi_session_file` text;

Until we distinguish by runtime via posthog django models

[jonathanlab]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat: hook up pi runtime to ChatThread #3474
• feat(harness): integrate pi runtime into desktop app #3469 👈 (View in Graphite)
• feat(harness): expose native Pi runtime #3391
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit ed3507d.}

[greptile-apps]

Security Review

The new Pi-session routes do not validate task ownership before controlling sessions or returning events. The child process also receives a reusable OAuth credential snapshot through its environment, which can become invalid when refresh tokens rotate.

_{Reviews (1): Last reviewed commit: "feat(harness): integrate pi runtime into..." | Re-trigger Greptile}

[greptile-apps]

Child Credentials Diverge After Refresh

The child receives a one-time copy of the desktop access and refresh tokens. If the provider rotates refresh tokens and the parent refreshes first, the long-running child retains the invalidated token and its next refresh fails even though the desktop remains signed in, interrupting the Pi session.