ecd11eff

By: ananjiani <ananjiani@noreply.codeberg.org>

feat(pi): native MCP, Codemode, free Jev, and Z.ai removal (#359)

## Summary

16-file branch: drop the MCP adapter, use Pi 1.1 native MCP, remove direct Z.ai.

```diff
 Pi
-  pi-mcp-adapter and direct Z.ai
+  native MCP and permanent Codemode
+  optional free Jev using the existing OpenCode key
 Other LLM services
-  claude-glm, Hermes GLM fallback, Bifrost Z.ai, Holmes Z.ai
+  Holmes default: existing opencode-kimi
 Secrets
-  unused Z.ai declarations
+  stored secret data stays intact
```

- codemode explicit; legacy `.mcp.json` untouched.
- Fixed: context7 `@upstash/context7-mcp`, nixos `uvx mcp-nixos`.
- Optional classifier `opencode/jev-1.13-free` reuses the Go workspace key. No AutoRouter, no JeV chat model, no raw key. Free only default. Report if unavailable or paid-only; paid needs approval. Rule, not billing lock.
- Kept: SOPS/OpenBao secret data, NVIDIA NIM GLM, OpenWebUI facade.

## Evidence

**Before:** Pi used the adapter and a GLM compaction fallback.
**After:** Native MCP works; Go compaction falls back to native Pi compaction.

- `bun test custom-compaction.test.ts`: 11 pass, 87 assertions. Normal commit hooks passed, including ripsecrets.
- Nix/YAML checks and both service kustomizations passed. Native MCP connected five servers; vault at `100.64.0.21:8282` still times out.
- Actual Pi 1.1 classifier call: `jev-1.13-free`, `stopReason: stop`, `choice: bug`, `confidence: 1`. Codemode active; no QuickJS script ran.
- Denethor omits the provider. Isolated resources point to the worktree. Normal config and Terraform stayed unchanged. Jev source review passed.
- Full `nix flake check --no-build` got SIGKILL before completion. Full builds, live routing, and cluster rollout remain untested. NixCI is pending.

## Merge Danger

**Door:** two-way. Reversible code/config only. No secrets deleted.

**Blast Radius:** homelab.

Affects Pi, Hermes, Claude, Bifrost, and Holmes. Pushing does not deploy. Merge only after required NixCI checks pass. Merging `main` starts Flux/Comin rollout. Update the local `main` checkout for Pi's linked resources. Holmes can add Go quota use. Free Jev is limited-time; paid fallback needs approval.

Co-authored-by: Ammar Nanjiani <ammar.nanjiani@gmail.com>
Reviewed-on: https://codeberg.org/ananjiani/infra/pulls/359