chore(vendor): import pi 1.3.0

Imported as a linear vendor commit so forge rebases do not replay the upstream root tree.

git-subtree-dir: third_party/pi

git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0

third_party/pi/packages/codemode/examples/cloudflare/sandbox/src/index.ts

@@ -0,0 +1,7 @@
+// The whole sandbox Worker: one Durable Object class that runs codemode scripts for callers bound to
+// it. Only Workers with a binding can reach the class; HTTP requests get a 404.
+export { CodemodeSandboxDurableObject as CodemodeSandbox } from "@earendil-works/pi-codemode/cloudflare";
+
+export default {
+	fetch: () => new Response("Not found", { status: 404 }),
+};

third_party/pi/packages/codemode/examples/cloudflare/sandbox/wrangler.jsonc

@@ -0,0 +1,13 @@
+{
+	"$schema": "node_modules/wrangler/config-schema.json",
+	"name": "pi-codemode-sandbox",
+	"main": "src/index.ts",
+	"compatibility_date": "2026-04-22",
+	// Reached only through Durable Object bindings, never over HTTP.
+	"workers_dev": false,
+	"preview_urls": false,
+	"migrations": [{ "tag": "v1", "new_sqlite_classes": ["CodemodeSandbox"] }],
+	// Optional. The default is 30 seconds of CPU per request; one execution is one request. Keep it above
+	// the time the interrupt budget allows, so scripts fail with a timeout instead of resetting the object.
+	"limits": { "cpu_ms": 60000 }
+}