make xhigh the sandbox's thinking, and stop settings.json freezing

Two changes, one bug found through the other.

Thinking is policy now: defaultThinkingLevel is xhigh unless you say otherwise
(thinking / --thinking / AISB_THINKING, with pi's levels plus 'host' to decline
and 'off' meaning pi's own no-reasoning level). It is written into the bridged
settings and re-applied by the entrypoint on every run, so a run cannot set its
own reasoning down for the runs after it. Unknown levels are refused with the
list to pick from. Nothing is written for codex, claude or a command after --,
and --no-pi-config declines it along with the bridge, because pi's own defaults
are what that flag asks for.

The reason xhigh had never reached a sandbox is worse than a missing default:
settings.json was managed as one whole file, and pi rewrites its own settings
(a theme change, "seen the changelog"), so the first such write matched nothing
and froze every host preference out permanently -- provider, model, thinking
budgets and level included, a real session left holding just
{"lastChangelogVersion": "1.4.0"}. It is merged per key instead, against a copy
of what we last wrote: a key edited in the sandbox stays edited, a key never
touched follows the host again, an untouched key the host dropped is dropped, a
key pi invented survives, and a file with no base copy takes the host values --
which repairs the volumes already frozen. Unparseable JSON is re-seeded with a
warning since pi cannot use it either; a file the container cannot read is
reported with the fix, because nothing inside the sandbox can repair one.

One trap worth remembering: the seeding script is passed to bash -c in single
quotes, so a single quote inside it closes the argument early and the rest runs
in the outer shell -- valid bash, wrong program, clean bash -n and clean
shellcheck. tests/unit/06_entrypoint.sh extracts the seeding script and asserts
it is quote-free, and extracts the merge program to test its semantics without
a container; tests/e2e/12_sandbox.sh does the same in a real run, including
forcing the level back after the sandbox sets it to off.

LLM-Generated: true

PLAN.md

@@ -127,6 +127,33 @@ the same destination wins because podman refuses duplicates. A missing or unread
 directory is a silent skip like the pi bridge's; an explicit `--agents-dir` that resolves
 to nothing is a hard error.
 
+### 11 — Thinking level as policy, and a settings merge that does not freeze
+`defaultThinkingLevel` is now `xhigh` by default (`thinking`, `--thinking`,
+`AISB_THINKING`; pi's own default is `medium`), written into the bridged settings and
+re-applied by the entrypoint on every run, so a run cannot lower the reasoning of the runs
+after it. `--thinking host` hands the key back to `settings.json`, `off` is pi's own
+"no reasoning" level, and an unknown value is refused with the list to pick from. Nothing
+is written for codex, claude or a command after `--`, and `--no-pi-config` declines the
+policy along with the bridge.
+
+Getting there found a worse bug. `settings.json` was managed as one managed file, and pi
+rewrites its own settings (a theme change, "seen the changelog"), so the first such write
+matched nothing and froze *every* host preference out of the sandbox for good -- provider, model,
+thinking budgets and the level included, with a real session left holding
+`{"lastChangelogVersion": "1.4.0"}`. It is merged per key instead, against a copy of what
+we last wrote (`.aisb-settings.json.wrote`): sandbox edits win per key, untouched keys
+follow the host again, untouched keys the host dropped are dropped, keys pi invented
+survive, and a file that is missing a base copy takes the host values -- which is what
+repairs the volumes already frozen. Unparseable JSON is re-seeded with a warning (pi
+cannot use it either); a file the container cannot *read* is reported with the fix, because
+nothing inside the sandbox can repair it.
+
+One trap worth remembering: the seeding script is passed to `bash -c` in single quotes, so
+a single quote anywhere inside it closes the argument early and the remainder becomes code
+in the outer shell -- valid bash, wrong program, invisible to `bash -n` and shellcheck.
+`tests/unit/06_entrypoint.sh` now extracts the seeding script and asserts it is quote-free,
+and extracts the merge program to test its semantics without a container.
+
 ## Follow-ups (not yet done)
 
 * **`--net unix` mode**: `--network=none` plus a unix-socket proxy and an in-container
@@ -150,6 +177,9 @@ to nothing is a hard error.
 * **Scoped sandbox tokens**: if the gateway can mint a short-lived, per-sandbox key,
   `--pi-token-env` should ask for one rather than forwarding the long-lived host
   credential. The bridge deliberately does not guess a minting endpoint.
+* **`--thinking` for the other harnesses**: codex and claude have their own reasoning
+  knobs; a policy that spans harnesses needs to know each one's config shape rather than
+  assume pi's.
 * **Bridging extensions/skills on request**: `--pi-mount-ext` or similar for the
   extension paths named in `enabledExtensionPaths`, which are host paths and therefore
   currently dropped; needs the same explicit-grant shape as `--mount`.