feat: complete evidence restructuring worktree

scripts/test-pi-user-auth-compose.sh

@@ -58,13 +58,24 @@ from pathlib import Path
 
 settings = json.loads(Path("deploy/pi/settings.json").read_text())
 assert settings["enabledModels"] == [
-    "zai/glm-5.2",
+    "zai/glm-5.3",
     "deepseek/deepseek-v4-flash",
     "deepseek/deepseek-v4-pro",
-    "aritmolab/qwen3.6-35b-a3b",
+    "local-qwen/qwen3.6-35b-a3b",
 ]
+models = json.loads(Path("deploy/pi/models.json").read_text())
+qwen = models["providers"]["local-qwen"]
+assert qwen["api"] == "openai-completions"
+assert qwen["models"][0]["id"] == "qwen3.6-35b-a3b"
+assert qwen["models"][0]["compat"]["maxTokensField"] == "max_tokens"
+assert "aritmolab" not in models["providers"]
 PY
 
+if grep -R -n 'registerProvider' harness/.pi/extensions; then
+  echo "Pi model providers must be declared in deploy/pi/models.json, not in code" >&2
+  exit 1
+fi
+
 grep -q '^ARG PI_VERSION=0.80.3$' docker/core.Dockerfile
 grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/local.env.example
 grep -q '^PI_AUTH_FILE=/absolute/path/to/pi-auth.json$' deploy/env/server.env.example