feat: package Pi extensions as Bun workspaces

extensions/native-hooks/skills/native-hook-authoring/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: native-hook-authoring
+description: Create, revise, validate, or troubleshoot trusted personal pi-native-hooks diagnostic and verification policies and ast-grep fixtures. Use when adding focused post-mutation policies without duplicating lifecycle, process execution, state, or delivery logic.
+compatibility: pi-native-hooks on Node >=22.19
+---
+
+# Native hook authoring
+
+1. Read [contracts](references/contracts.md). Import policy contracts with `import type` only.
+2. Keep evaluators pure. Request analyzer keys and consume immutable snapshots; never spawn analyzers, linters, LSPs, or shell processes from a policy.
+3. Add or revise a fixture under the package's `tests/fixtures/personal-config`, not the live personal root.
+4. For syntax steering, create warning/info/hint ast-grep rules with language-specific IDs and a rationale-bearing `ast-grep-ignore` example.
+5. Run the focused fixture, `npm run typecheck`, and `npm test` as described in [testing](references/testing.md).
+6. Preview personal installation with `/hooks-init --dry-run`. Never write `~/.config/pi-native-hooks` without explicit interactive authorization. Existing files must not be overwritten.
+
+Personal modules are trusted arbitrary code with Pi's authority. Validation is not sandboxing. Use Node's erasable TypeScript subset only.

extensions/native-hooks/skills/native-hook-authoring/references/contracts.md

@@ -0,0 +1,16 @@
+# Policy contracts
+
+The authoritative declarations are exported by `@_jb/pi-native-hooks/policy` from `src/policy.ts`. Do not copy them into personal config.
+
+A diagnostic policy declares `kind`, a unique `id`, analyzer keys, `appliesTo`, and a pure `evaluate`. `evaluate` receives readonly normalized snapshots and a process-free policy context. Filter findings by exact rule ID and return bounded guidance plus the supported suppression form.
+
+A verification policy declares a project matcher and exact requirements. Each requirement owns an exact command, `cwd: "project-root"`, and a pure `affects(path)` predicate. Do not infer scripts or accept command variants.
+
+Use:
+
+```ts
+import type { DiagnosticPolicy } from "@_jb/pi-native-hooks/policy";
+export default { /* ... */ } satisfies DiagnosticPolicy;
+```
+
+No runtime import is needed. Enums, namespaces, parameter properties, JSX, and tsconfig transforms are unsupported in personal modules.

extensions/native-hooks/skills/native-hook-authoring/references/testing.md

@@ -0,0 +1,16 @@
+# Policy testing
+
+Work only in repository fixtures until activation is explicitly approved.
+
+1. Put policy fixtures in `tests/fixtures/personal-config/policies/`.
+2. Put ast-grep rules below `tests/fixtures/personal-config/ast-grep/rules/` and keep severity below `error`.
+3. Cover TS and TSX positives, nearby negatives, the exact named suppression with a `-- rationale`, Unicode ranges, and malformed analyzer output where relevant.
+4. Assert multiple policies sharing one analyzer key cause one adapter invocation.
+5. Run:
+
+```bash
+npm run typecheck
+npm test
+```
+
+Use `/hooks-doctor` only after authorized initialization. Never make a policy evaluator invoke `ast-grep`, a linter, LSP, shell, or Pi API directly.