update pi.md with real pi agent config

Sync the documented models.json example with the actual
~/.pi/agent/models.json (maxTokens 32000 -> 32768) and add the
full ~/.pi/agent/settings.json to the doc.

LLM-Generated: true

active/software_pi/pi.md

@@ -36,7 +36,7 @@ This is my ~/.pi/agent/models.json
           "input": ["text", "image"],
           "reasoning": true,
           "contextWindow": 262144,
-          "maxTokens": 32000,
+          "maxTokens": 32768,
           "thinkingLevelMap": {
             "off": "none",
             "minimal": null,
@@ -52,7 +52,7 @@ This is my ~/.pi/agent/models.json
           "input": ["text", "image"],
           "reasoning": true,
           "contextWindow": 262144,
-          "maxTokens": 32000,
+          "maxTokens": 32768,
            "thinkingLevelMap": {
             "off": "none",
             "minimal": null,
@@ -68,3 +68,72 @@ This is my ~/.pi/agent/models.json
   }
 }
 ```
+
+This is my ~/.pi/agent/settings.json
+
+```json
+{
+  "lastChangelogVersion": "1.3.0",
+  "theme": "dark/dark",
+  "defaultProvider": "reeseapps-aipi",
+  "defaultModel": "turbo",
+  "httpIdleTimeoutMs": 0,
+  "enableInstallTelemetry": false,
+  "doubleEscapeAction": "tree",
+  "images": {
+    "autoResize": false
+  },
+  "editorPaddingX": 0,
+  "defaultThinkingLevel": "xhigh",
+  "hideThinkingBlock": false,
+  "thinkingBudgets": {
+    "minimal": 1024,
+    "low": 4096,
+    "medium": 10240,
+    "xhigh": 65536
+  },
+  "steeringMode": "all"
+}
+```
+
+## Installing for sysadmin work
+
+I would absolutely recommend installing pi under a special user (I call mine
+`ops`) with limited sudoers access that you tightly control. Pair that with the
+following AGENTS.md at `/home/ops/AGENTS.md`:
+
+```text
+# AGENTS.md
+
+## Sudo policy
+
+The `ops` user on this machine has **limited sudoers capabilities**. The exact
+allowlist is discoverable at any time with:
+
+sudo -l
+
+Allowed (NOPASSWD) commands currently include: `hostnamectl hostname`, `reboot`,
+`dnf update/upgrade/install/remove/clean/makecache/autoremove`,
+`dnf config-manager addrepo`, `systemctl start/restart/reload/enable`,
+`firewall-cmd`, the ansible shim, `qemu-img`, `virsh`, `virt-install`,
+`composer-cli`, `getfacl`, specific `setfacl` invocations,
+`/usr/local/sbin/osbuild-auto.sh`, and `btrfs scrub`.
+
+## Rule for agents
+
+If you (the agent) believe you need a permission that is **not** in the
+`sudo -l` allowlist — i.e., a command fails with a sudo permission error, or a
+task requires root access you do not have — you must:
+
+1. **Stop** and do not attempt workarounds that bypass sudo (no password
+   guessing, no escalating via other users, no trying to write to root-owned
+   paths without permission).
+2. **Ask the human** to update sudoers with the specific command(s) you need,
+   stating exactly which command(s) and arguments should be added so the user
+   can review and approve them. Requests must be correct and copy-pastable,
+   using full command paths in standard sudoers format, e.g.
+   `ops ALL=(root) NOPASSWD: /usr/sbin/btrfs scrub*`
+
+Do not proceed with root-only operations until the user has confirmed the
+sudoers entries have been added.
+```