Upgrade the Atomic harness to 0.9.28 and the Pi harness to 1.0.148

@bastani/atomic, @bastani/atomic-natives and @bastani/pi-ai move to
0.9.28, and Atomic's @earendil-works packages to 1.1.0. The five
builtin packages are unchanged, so BUILTINS_OFF still turns off each
one for the isolated Planner. Atomic 0.9.28 also moves OpenAI's
decision classifier to its own openai-decisions provider; Chopin uses
no classifier, so nothing here changes for it.

@ai-sdk/harness-pi moves to 1.0.148, which pins @ai-sdk/harness
1.0.146 and ai 7.0.135, so @ai-sdk/harness and
@ai-sdk/sandbox-just-bash follow to 1.0.146 and @ai-sdk/mcp to 2.0.72,
keeping one @ai-sdk/provider-utils. @earendil-works/pi-coding-agent
stays at 0.85.1, the newest release harness-pi accepts.

- harness-pi 1.0.148 fails a turn for a model outside Pi's catalog on
  its own, so the patch keeps only the change that stops Pi reading
  AGENTS.md and CLAUDE.md from the host. The Pi contract test now
  expects upstream's message.
- e2e's fake and prompt-scripted harnesses imported the harness types
  through apps/server/node_modules by relative path. TypeScript then
  loads a second copy of the package whose own imports don't resolve,
  and 1.0.146's message types stop matching the server's. They now
  import from apps/server/src/harness/harness-v1.ts, which resolves the
  package normally, and the fake harness reads text only from text
  parts.

Assistant-workflow: inline
Assistant-model: Claude Opus 5.5 (fast)
Assistant-verification: bun test passed: 4407 pass, 3 skips, 0 fail, with GIT_CONFIG_GLOBAL=/dev/null; the same 47 scripts/pr-maintenance tests fail on main too when the global git config signs commits
Assistant-verification: bun run types passed: all workspace checks, including e2e
Assistant-verification: bun run ci passed: dprint, oxlint, tokens, design contract, design record, Impeccable (no new findings)
Assistant-verification: playwright e2e passed: harness.e2e.ts and smoke.e2e.ts; responsive-activity.e2e.ts has one failure ("a closed desktop Chat tab keeps unread activity visible") that also fails on main
Assistant-verification: source check passed: Atomic 0.9.28 dist/builtin lists intercom, mcp, subagents, web-access, workflows; harness-pi 1.0.148 dist rejects unknown models and still rejects JSON responseFormat
Co-authored-by: Alex Lavaee <lavaman131@github.com>