Moves the Atomic harness to 0.9.28 and the Pi harness to the newest `@ai-sdk/harness-pi`, 1.0.148, with the AI SDK packages that release pins.

## What changes

**Atomic** - `package.json`: the `harness` catalog moves `@bastani/atomic` from `0.9.27` to `0.9.28`. - `bun.lock`: `@bastani/atomic`, `@bastani/atomic-natives` and `@bastani/pi-ai` move to 0.9.28. Atomic's `@earendil-works` packages move from 1.0.2 to 1.1.0. - The five builtin packages (intercom, mcp, subagents, web-access, workflows) are unchanged, so `BUILTINS_OFF` still turns off each one for the isolated Planner. - Atomic 0.9.28 moves OpenAI's decision classifier from `openai/gpt-6-luna` to its own `openai-decisions` provider. Chopin calls no classifier, so this changes nothing here.

**Pi harness and AI SDK** - `@ai-sdk/harness-pi` 1.0.128 → 1.0.148. That release pins `@ai-sdk/harness` 1.0.146 and `ai` 7.0.135. So `@ai-sdk/harness` and `@ai-sdk/sandbox-just-bash` go to 1.0.146, `ai` to 7.0.135, and `@ai-sdk/mcp` to 2.0.72, leaving one `@ai-sdk/provider-utils` (5.0.58). - `@earendil-works/pi-coding-agent` stays at 0.85.1. harness-pi 1.0.148 still requires `^0.85.1`, so 1.x would be a second, mismatched copy.

**The harness-pi patch** - 1.0.148 now fails a turn for a model outside Pi's catalog itself ("Harness 'pi' has no model … in its catalog."), so that half of the patch is dropped. The Pi contract test expects upstream's message; it still checks that no model request is made. - The other half, `noContextFiles: true` so Pi never reads `AGENTS.md`/`CLAUDE.md` from the host, is ported to `patches/@ai-sdk%2Fharness-pi@1.0.148.patch`. The Pi contract test for it passes. - 1.0.148 still rejects JSON `responseFormat`, so the inline result-tool extension stays. - `docs/self-hosting.md` and `docs/hosted-agent.md` describe 1.0.148.

**e2e harness types** - `e2e/harness/fake-harness.ts` and `e2e/harness/scripted-planner.ts` imported the harness types by relative path through `apps/server/node_modules/@ai-sdk/harness`. TypeScript then treats that as a second copy of the package whose own imports (`@ai-sdk/provider`, `@ai-sdk/provider-utils`) don't resolve, and on 1.0.146 the server's job-prompt fixtures stop type-checking against it. - They now import from `apps/server/src/harness/harness-v1.ts`, a type-only re-export that resolves the package normally. With real types, `promptText` in the fake harness reads `text` only from text parts.

## Verification

- `bun test`: 4407 pass, 3 skip, 0 fail. This used `GIT_CONFIG_GLOBAL=/dev/null`: with my global config's SSH commit signing, the same 47 `scripts/pr-maintenance` tests fail on `main` too, because their fixtures run `git commit`. - `bun run types`: all workspace checks pass, including e2e. - `bun run ci`: dprint, oxlint, tokens, design contract, design record, and Impeccable pass, with no new findings. - `bun run e2e` for `harness.e2e.ts`, `smoke.e2e.ts` and `responsive-activity.e2e.ts`: 32 pass, 1 fail. The failure, "a closed desktop Chat tab keeps unread activity visible", fails the same way on `main`. - Not run: a live Planner session on either harness.

Assistant-workflow: inline Assistant-duration: unmeasured converged, estimated unmeasured Assistant-verification: bun test passed: 4407 pass, 3 skips, 0 fail (GIT_CONFIG_GLOBAL=/dev/null) Assistant-verification: bun run types passed: all workspace checks, including e2e Assistant-verification: bun run ci passed: no new findings Assistant-verification: playwright e2e passed: harness and smoke specs; one responsive-activity failure also fails on main Assistant-verification: source check passed: Atomic 0.9.28 builtins unchanged; harness-pi 1.0.148 rejects unknown models and JSON responseFormat User-preference: Upgrade Atomic and the Pi harness together with their transitive deps Co-authored-by: Alex Lavaee <lavaman131@github.com>