Generate Pi provider reference from installed package

[sentry-junior]

Warden's Pi provider docs (selector formats, env vars, caveats) are hand-authored and will drift as Pi adds providers and models. Pi currently ships 35 providers and 968 models in a machine-readable models.generated.ts; a nightly workflow already follows this pattern for model pricing.

Proposed shape

Three files:

• pi-providers.generated.json — generated from the locked Pi version: provider IDs, model IDs/names, context window, reasoning flag. Regenerated whenever @earendil-works/pi-* is bumped.
• pi-provider-overrides.json — hand-authored: auth type, multi-part env vars (e.g. CLOUDFLARE_ACCOUNT_ID), Warden env aliases, recommended example selectors, per-provider caveats, support level (recommended / documented / advanced / hidden), and targeted invalid-selector hints.
• pi-provider-reference.generated.json — merged artifact consumed by docs, skills reference, and CLI hint logic.

Scope

• scripts/update-pi-providers.ts: reads installed Pi via getProviders()/getModels(), writes generated snapshot
• pi-provider-overrides.json: initial curated overlay for the providers documented in PR fix(sdk): reject Cloudflare-native model IDs, bridge multi-part auth env vars #397
• CI check (update-pi-providers --check): fails if generated file is stale; validates curated example selectors still resolve in Pi registry
• models.mdx and config-schema.md rendered from merged reference (main table stays curated ~8 recommended providers, not all 968 models)
• Scheduled workflow analogous to update-pricing.yml: bumps Pi dep + regenerates in the same PR
• Wire curated hints into invalidPiModelSelectorMessage / piModelSelectorTip from overlay rather than hardcoded strings

Key constraints

• Generated data must come from the lockfile-installed Pi version, not upstream latest — docs should describe what Warden actually ships
• Full model list is checked-in JSON but not prominently rendered in docs
• OAuth/IAM providers (GitHub Copilot, Bedrock, Vertex) need explicit authType in overlay so docs don't imply WARDEN_X_API_KEY works for them
• CI should validate that curated example selectors still exist in Pi's registry after each Pi bump

Refs #397.

Action taken on behalf of immutable dcramer.