FN-6218: restore pi upgrade compatibility

Restore Pi-upgraded workspaces to keep Fusion resources accessible and recover title generation when configured models go stale.

- Mark read-only Fusion/Pi provider settings views as project-trusted so extension loading keeps working after Pi upgrades.
- Retry task title summarization with automatic model resolution when the configured provider model is missing from the Pi registry.
- Cover provider settings trust behavior and stale summarizer fallback paths with regression tests.
- Document the read-only settings trust contract and add a patch changeset.

Files changed:
 .changeset/fn-6218-pi-upgrade-regressions.md       |   5 +
 docs/settings-reference.md                         |   2 +
 docs/task-management.md                            |   2 +
 .../commands/__tests__/provider-settings.test.ts   |  16 ++++
 packages/cli/src/commands/provider-settings.ts     |   5 +
 packages/core/src/__tests__/ai-summarize.test.ts   | 102 +++++++++++++++++++++
 packages/core/src/ai-summarize.ts                  |  85 ++++++++++++-----
 .../src/__tests__/pi-create-fn-agent.test.ts       |  32 +++++++
 packages/engine/src/pi.ts                          |   7 +-
 9 files changed, 233 insertions(+), 23 deletions(-)

Fusion-Task-Id: FN-6218

Fusion-Task-Lineage: 3d6aca32-a56a-43a0-a57b-8e6abc839ce9

packages/cli/src/commands/__tests__/provider-settings.test.ts

@@ -46,6 +46,22 @@ describe("createReadOnlyProviderSettingsView", () => {
       shared: "fusion",
     });
     expect(view.getNpmCommand()).toEqual(["pnpm"]);
+    expect(view.isProjectTrusted()).toBe(true);
+  });
+
+  it("exposes project trust for pi package-manager discovery consumers", async () => {
+    const root = tempWorkspace("fusion-provider-settings-");
+    const cwd = join(root, "project");
+    const agentDir = join(root, "agent");
+    mkdirSync(agentDir, { recursive: true });
+
+    const view = createReadOnlyProviderSettingsView(cwd, agentDir);
+    const discoveryConsumer = {
+      resolve: vi.fn(async () => view.isProjectTrusted()),
+    };
+
+    await expect(discoveryConsumer.resolve()).resolves.toBe(true);
+    expect(typeof view.isProjectTrusted()).toBe("boolean");
   });
 
   it("returns empty project settings when .fusion/settings.json does not exist", () => {

packages/cli/src/commands/provider-settings.ts

@@ -5,6 +5,7 @@ export interface PackageManagerSettingsView {
   getGlobalSettings(): Record<string, unknown>;
   getProjectSettings(): Record<string, unknown>;
   getNpmCommand(): string[] | undefined;
+  isProjectTrusted(): boolean;
 }
 
 function siblingAgentDir(agentDir: string, siblingRoot: ".fusion" | ".pi"): string | undefined {
@@ -47,6 +48,10 @@ export function createReadOnlyProviderSettingsView(cwd: string, agentDir: string
     getNpmCommand: () => Array.isArray(mergedSettings.npmCommand)
       ? [...mergedSettings.npmCommand]
       : undefined,
+    // Pi's SettingsManager defaults projects to trusted. Fusion workspaces are
+    // user-owned, so preserve pre-upgrade behavior and keep project-scoped
+    // .fusion resources loadable through the read-only settings view.
+    isProjectTrusted: () => true,
   };
 }