fix(pi): reject unsupported tool categories before launch

[Florious95]

Pi role tool categories previously compiled successfully even when the Pi launcher could not support them, so startup failed after configuration had been accepted. Compile/spec validation now uses the Pi adapter's capability mapping and rejects unsupported categories before runtime persistence. Shipped skill guidance distinguishes the Pi and Codex tool contracts.

Validation:

• Base: release/0.5.74-startup-routing at f2926d467f45d684549054bcc562607a255e6eea; head 99e901b408382d1c9ebae204e1923bd85062e4ff.
• Grok Bot scoped-a2: four owning compile/spec/quick-start tests actually executed, 4 passed, 0 failed. Fetched ExecMainStatus=0, artifact verification, receipt-bound wipe, and local cleanup completed.
• Previous scoped-a1 exited 6 because the runner selected an incorrect test module path; it executed zero product tests. Earlier sync failures remain recorded as apparatus failures, not product results.
• Diff and skill link checks passed. No local Rust execution. Scoped success does not replace final combined-candidate validation or release gates.

Addresses #129.