📝 Document the .pi extension install model

.pi/settings.json is the shared, committed declaration and .pi/npm/ is
a gitignored cache pi recreates on a trusted startup, so the generated
.gitignore is intentional and nothing needs tracking. Record this in
the README tooling notes and close the reproducibility item as
resolved by design.

backlog.tasks

@@ -8,11 +8,10 @@ Setup:
 ✔ Establish release CI workflow: post-tag checks + npm publish after release tag push => pi --session 01a06e72-e61e-7327-b3e9-3e11749a523f @high @done (9/11/2026, 12:37:35 AM)
 ☐ Add gitea release page in CI @high
 ☐ Split off template into separate package => pi --session 01a07dde-7050-7054-bb36-1606d7eb2bc3 @high
-☐ Make the pi-lsp install reproducible
+✔ Make the pi-lsp install reproducible @done
     - `.pi/npm/.gitignore` is `*` / `!.gitignore`, so only `.gitignore` is committed; `.pi/npm/package.json` and `package-lock.json` are untracked
     - the README insists `@spences10/pi-lsp` is "pinned to 0.0.46", but the lockfile that pins the transitive tree does not survive a fresh clone
-    ☐ Commit `.pi/npm/package.json` + `package-lock.json` (recommended: treat it as a dev-environment lockfile, same class as the root one)
-    ☐ Or document that pi self-installs the extension and the pin is advisory — decide which
+    ✔ Resolved by design, no change: `.pi/settings.json` is the shared committed declaration (`npm:@spences10/pi-lsp@0.0.46`), and `.pi/npm/` is a gitignored install cache pi recreates on a trusted startup (settings.md: trusting a project allows pi to "install missing project packages"). The .gitignore is intentional; the exact pin lives in the committed settings file. README clarified @done
 ✔ Gate the emit path in `npm run verify` @done
     - `verify = check + test:unit`; `check:tsc` uses the root config (`noEmit: true`), so `tsconfig.build.json` is only exercised by `build`
     - a broken build config (bad `rootDir`, emit-option typo) passes `verify` and only fails in CI