feat(#6571): add xai-vertex provider to the pi runtime

AGENTS.md

@@ -27,6 +27,7 @@ Detailed guidance lives in `docs/contributing/` and topic-specific guides under
 
 | File | When to read |
 |------|-------------|
+| [Runtime Implementation](docs/contributing/runtime-implementation.md) | Adding or changing a `runtime.Runtime` backend — covers the security feature matrix every runtime must fill in, the runtime interfaces, the sandbox hook contract and wire protocol, and the sandbox workspace layout |
 | [Go Code](docs/contributing/go-code.md) | Changing Go code under `cmd/` or `internal/` — covers mint sync, coverage, vet, e2e tests, concurrency testing, suite-timeout policy, WASM binary size constraints, and preferring `go run` for the CLI |
 | [Mintcore Architecture](docs/contributing/mintcore.md) | Changing `internal/mintcore/`, `cmd/mint-wasm/`, `cmd/mint/`, or `internal/mint/` — covers platform accessors, load-site construction, and WASM-safe wiring |
 | [Behaviour Testing](docs/guides/dev/behaviour-testing.md) | Modifying behaviour test repo provisioning, fork handling, or workflow dispatch — covers forge API constraints (`auto_init`, fork name derivation, Actions readiness, CI timeout budgeting) |

docs/.vitepress/config.ts

@@ -205,7 +205,12 @@ export default defineConfig({
         },
         {
           text: "Runtimes",
+          collapsed: true,
           link: "/runtimes",
+          items: [
+            { text: "Claude Code", link: "/runtimes/claude" },
+            { text: "Pi", link: "/runtimes/pi" },
+          ],
         },
         {
           text: "Agents",
@@ -335,7 +340,7 @@ export default defineConfig({
       provider: "local",
       options: {
         scopes: [
-          { label: "Guides", prefixes: ["/docs/guides/", "/docs/agents/", "/docs/cli/"] },
+          { label: "Guides", prefixes: ["/docs/guides/", "/docs/agents/", "/docs/cli/", "/docs/runtimes"] },
           {
             label: "Design Docs",
             prefixes: ["/docs/problems/", "/docs/ADRs/", "/docs/normative/", "/docs/spikes/"],

docs/ADRs/0090-runtime-neutral-sandbox-hooks-contract.md

@@ -57,7 +57,7 @@ feature:
   PreToolUse/PostToolUse phases with Claude tool names as the canonical
   vocabulary. Claude's `GenerateClaudeSettings` is rendered from `HookPlan`
   so the two cannot diverge. The stdin/stdout/exit-code wire protocol is
-  documented in [runtimes.md](../runtimes.md#sandbox-hook-contract).
+  documented in [runtimes.md](../contributing/runtime-implementation.md#sandbox-hook-contract).
 - The bootstrap extension is `runtime.SandboxHooksBootstrap` (carrying
   `security.SandboxHookConfig`). Every runtime's `Bootstrap` SHOULD honour it
   by installing the scripts (`installHookScripts`, any directory) and wiring
@@ -95,7 +95,7 @@ feature:
 > PostToolUse contract v2 — scripts read `tool_response` (fallback
 > `tool_result`), replace via `hookSpecificOutput.updatedToolOutput`, and
 > enforce unicode → canary → suppress → redact in `posttool_chain.py`. See
-> [runtimes.md](../runtimes.md#sandbox-hook-contract).
+> [runtimes.md](../contributing/runtime-implementation.md#sandbox-hook-contract).
 
 > **Done ([#608](https://github.com/fullsend-ai/fullsend/issues/608)):**
 > The canonical Claude tool-name vocabulary is recorded once in
@@ -112,4 +112,4 @@ feature:
 > as a forbidden tool (`tool_blocked`, `critical`). MCP names are matched
 > verbatim. The pi adapter's maps are held to canonical-or-legacy names
 > (`ls` → `LS`), a deliberate relaxation of "canonical only". See
-> [runtimes.md](../runtimes.md#sandbox-hook-contract).
+> [runtimes.md](../contributing/runtime-implementation.md#sandbox-hook-contract).

docs/guides/getting-started/choosing-a-runtime.md

@@ -21,7 +21,7 @@ Fullsend supports multiple agent runtimes. A runtime is the program that runs in
 
 1. **Next step — Configuring GitHub.** `fullsend github setup <owner/repo>` asks which runtime to use when run from a terminal; press Enter to keep `claude`. Passing `--runtime` skips the prompt. The setup PR it opens records the choice in `.fullsend/config.yaml` and describes how to change it. Nothing runs on this page — continue with [Configuring GitHub](configuring-github.md).
 2. **Later — changing it.** Edit `runtime:` in the repo's `.fullsend/config.yaml` (the setup PR shows the key), or re-run `fullsend github setup <owner/repo> --runtime <claude|pi>`. Fleets managed through `repos.yaml` set `defaults.runtime` (or a per-entry `runtime`) — `fullsend repos set-default defaults.runtime pi` — and run `fullsend repos install`; see [fullsend repos](../../cli/repos.md).
-3. **Per run — trying without changing the repo.** `fullsend run --runtime pi --model google-vertex/gemini-2.5-flash`, or the `FULLSEND_RUNTIME` / `FULLSEND_MODEL` / `FULLSEND_EFFORT` environment variables (flag beats environment beats config). In CI the same names work as repository variables. Reference: [fullsend run](../../cli/run.md) and [Runtimes — selecting and overriding](../../runtimes.md#selecting-and-overriding).
+3. **Per run — trying without changing the repo.** `fullsend run --runtime pi --model google-vertex/gemini-2.5-flash`, or the `FULLSEND_RUNTIME` / `FULLSEND_MODEL` / `FULLSEND_EFFORT` environment variables (flag beats environment beats config). In CI the same names work as repository variables. Reference: [fullsend run](../../cli/run.md) and [Runtimes — selecting and overriding](../../runtimes.md#selecting-a-runtime-and-model).
 
 ## Where to see what ran
 

docs/guides/user/running-agents-locally.md

@@ -282,7 +282,7 @@ config-registered agent to a local harness directory.
 
 > For background on the pi runtime, its security posture, and known
 > constraints, see [Agent runtimes — Pi-specific known
-> constraints](../../runtimes.md#pi-specific-known-constraints-6464).
+> constraints](../../runtimes/pi.md).
 
 ### Prerequisites (pi-specific)