fix(tui): show cleanup approval wait instead of running Bash

[testikun]

Problem

Fixes #544. Pi emits tool_execution_start before OpenPI’s tool_call cleanup guard finishes. While a guarded rm is awaiting confirmation, the compact Bash row incorrectly says Running rm keep.txt and advances a timer, although the command has not executed.

Value

Users can distinguish a pending decision from active Bash execution. The waiting row does not keep animating or repainted every second while a person decides.

Approach

The cleanup guard publishes the confirmation phase on Pi’s extension EventBus with Session and tool-call identity. The TUI-only file-mutation display projects it as Awaiting approval, clears its execution timer during the wait, and resumes Running after approval. Refusal/cancellation remains awaiting until the blocked result is shown. The guard decision, confirmation choices/default, actual tool definition and execution semantics are unchanged.

The source-scoped investigation is recorded in docs/research/ISSUE_544_CLEANUP_CONFIRMATION_UI_2026-09-17.md.

Validation

• bun run check: passed (using Bun 1.3.14 via npm exec in this shell).
• bun run test: 1661 passed, 1 skipped, 0 failed; Vitest 220 passed.
• Focused guard, renderer, and cross-extension EventBus tests: 22 passed.
• Pi 0.85.1 interactive TUI/PTY with a single local OpenPI source at f6b49ae: holding confirmation for >3 seconds showed one Awaiting approval row and no Running rm keep.txt row during the wait. Esc preserved the pre-existing file; approval resumed running and deleted it.
• Ablation: removing the event-driven invalidation brought repeated Running rows back, so it remains necessary.

Impact

• User-visible: the collapsed Bash tool row distinguishes the confirmation phase and no longer shows a running timer during it.
• Model-visible context/tools: none. Tool schema, prompt metadata, execution and result are preserved.
• Runtime/lifecycle: one ephemeral, Session-scoped Pi EventBus phase signal and per-call renderer invalidation; no persistence or permission changes.
• Persisted config/data: none. Compatibility risk is limited to Pi TUI projection; headless Sessions keep native tool definitions. The separately reported white read/grep flashing is not reproduced on current main and is not addressed by this PR.