merge: integrate xAI subscription auth from main

Both conflicts were adjacency rather than intent. Main rewrote only the Pi
Credential Reuse bullet while Capella rewrote the Audit System bullet beside it,
and the two branches added grok-mermaid and handlebars at the same alphabetical
slot in the lockfile. The pi bump to 0.84.2 also widened StopReason with two
states the Capella structured-generation port could not compile against.

- keep main's Pi bullet and Capella's Audit bullet, whose prose matches the code
- keep both lockfile entries; pnpm install --lockfile-only reproduces the result
- classify the new pending and deferred stop reasons as a rejected request

apps/worker/package.json

@@ -39,9 +39,9 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@earendil-works/pi-agent-core": "^0.82.1",
-    "@earendil-works/pi-ai": "^0.82.1",
-    "@earendil-works/pi-coding-agent": "^0.82.1",
+    "@earendil-works/pi-agent-core": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-coding-agent": "^0.84.2",
     "@gotgenes/pi-permission-system": "^10.9.0",
     "@temporalio/activity": "1.15.0",
     "@temporalio/client": "1.15.0",

apps/worker/src/ai/pi/structured-generation.ts

@@ -102,7 +102,11 @@ async function generate(host: ModelHost, request: StructuredGenerationRequest):
     };
   }
 
-  if (response.stopReason === 'error') {
+  // `pending` and `deferred` are non-final provider states: completeSimple resolves only on a
+  // finished response and Shannon never requests a deferred one, so neither can carry a usable
+  // submission. Classify them the way a rejected request is classified, so the caller retries
+  // instead of reading an empty response as a successful generation.
+  if (response.stopReason === 'error' || response.stopReason === 'pending' || response.stopReason === 'deferred') {
     const failure = host.classify(response);
     return {
       stopReason: 'error',