fix(coding-agent): preserve nested legacy config

[code-yeongyu]

Summary

Fixes a startup migration gap that stranded custom model config under nested legacy senpi paths such as ~/.senpi/.pi/agent. The user-facing impact is that custom models.json entries and favoriteModels can reappear after migration instead of being hidden from the model picker.

Root cause: the previous migration skipped legacy directories whenever the current target directory already existed. That protected existing files, but it also stranded missing files such as models.json. While fixing that, the migration also needed to avoid draining ~/.pi -> ~/.senpi symlinked home config into external sandbox agent dirs.

Changes

• Split extension-system migration helpers out of migrations.ts so startup migration code stays smaller and focused.
• Added legacy-senpi-dir-migration.ts to move only missing files from legacy/nested config directories without overwriting current files.
• Guarded global home migration so external SENPI_CODING_AGENT_DIR sandboxes do not consume real home config through .pi symlinks.
• Added regression coverage for nested legacy file recovery and the symlink/sandbox guard.

QA / Evidence

• npx tsx ../../node_modules/vitest/dist/cli.js --run test/senpi-migration.test.ts from packages/coding-agent: 3 tests passed.
• npm run check: passed; also re-run by the commit hook with no fixes applied.
• node .agents/skills/senpi-qa/scripts/cli-smoke.mjs --self-test: 5/5 passed. Evidence: local-ignore/qa-evidence/20260701-nested-senpi-pi-migration/cli-smoke-final-after-guard.txt.
• node .agents/skills/senpi-qa/scripts/mock-loop.mjs --self-test: 5/5 passed, including Anthropic Messages baseUrl override through the real loop and zero real provider calls. Evidence: local-ignore/qa-evidence/20260701-nested-senpi-pi-migration/mock-loop-final-after-guard.txt.
• Manual local model surface check: modelsError null; favorites resolved to anthropic/claude-opus-4-8, anthropic/claude-opus-4-7, anthropic/claude-opus-4-6, and apitopia/glm-5.2.

Risks

• Migration behavior changes are startup-sensitive, but tests cover the two risky edges: preserving existing current files while moving missing nested files, and not draining symlinked home config into external sandboxes.
• External custom model credentials are not committed; local model restoration uses existing local configuration references only.

Secret safety

No raw tokens, auth headers, OAuth blobs, or private credentials are included in the diff or PR text. QA evidence uses isolated fake-provider runs and only records sanitized paths/results.

---

Summary by cubic

Fixes startup migration to recover nested legacy Senpi config under ~/.senpi/.pi/* without overwriting current files. Restores models.json and favorites in the model picker, and prevents draining home config into external sandboxes.

• Bug Fixes

  • Move only missing files from ~/.senpi/.pi/agent/mom and project .pi into the current ~/.senpi layout; keep existing files intact.
  • Guard home-config migration so .pi symlinks don’t pull config into external sandboxes when SENPI_CODING_AGENT_DIR points outside the home dir.

• Refactors

  • Extracted extension-system logic to extension-system-migration.ts and added legacy-senpi-dir-migration.ts; slimmed migrations.ts.
  • Added tests covering nested file recovery and the sandbox/symlink guard.

^{Written for commit 9a71aae. Summary will update on new commits.}