Oh My Pi v17.3.8: compaction hardening, permission query handling, Qwen thinking effort fix

@oh-my-pi/pi-agent-core

• /compact no longer resurrects pre-/clear turns: prepareCompaction now honors the latest reset_boundary
• Compaction summarization hardened against prompt injection: conversation history and previous summaries treated as untrusted, embedded <conversation>/<previous-summary> tags neutralized
• Compaction input bounded to summary model's context via windowed fold; context-overflow 400s no longer retried against full budget
• Remote compaction message ordering fixed for opencode-go gateways: assistant messages wedged between tool-call batch and outputs are now hoisted ahead of the batch

@oh-my-pi/pi-ai

• Gemini thought summaries no longer leak raw fence delimiters into reasoning display or transcripts
• OpenCode Go login prompt now correctly names OpenCode Go (not "OpenCode Zen")
• Anthropic-compatible endpoints with strict validation (e.g. Z.AI GLM) now accept empty successful tool_result blocks encoded as content: "" instead of content: []
• retry.usageReservePct now correctly observes Claude Fable/Mythos weekly tier usage
• Cursor agent streams no longer stall on interaction_query permission frames: hosted search/fetch approved, unnamed permission fields answered, unservable prompts rejected
• Thinking effort selections now apply to local Qwen 3.8+ models on llama.cpp and vLLM via reasoning_effort kwarg
• OpenAI Completions, Amazon Bedrock, and Cursor providers now respect onPayload replacement payloads
• Codex unentitled-model denials classified as account-policy errors for credential rotation
• Perplexity email-OTP login fixed for renamed challenge_token field
• Cloud Code Assist Gemini requests at minimal now send thinkingLevel: LOW instead of MINIMAL
• Flattened array argument paths (e.g. Gemini's questions[0].id) are now rebuilt into nested arrays
• opencode-go turn ordering fixed for trailing text/thinking blocks after tool calls