feat: Orquestra - sequential orchestration runtime

- Context isolation: fresh Pi process per stage (run_stage.py)
- Gate enforcement: blocks close without approved gates
- Auto commit/push on feature close (close_feature.py)
- Write restrictions: only allowed directories (ALLOWED_WRITE_DIRS)
- Pi extension: orquestra-status with /orquestra-stage command
- Documentation: context-handoff.md, updated README
- Scripts: agent_status.py, verify.sh, install.sh updated

scripts/pi_orquestra.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+
+if ! command -v pi >/dev/null 2>&1; then
+  echo "[FAIL] pi is required before running Orquestra" >&2
+  exit 1
+fi
+
+STATUS_EXT=".pi/extensions/orquestra-status"
+WEB_FETCH_EXT=".pi/extensions/orquestra-web-fetch.ts"
+ENGRAM_EXT="$HOME/.pi/agent/npm/node_modules/gentle-engram/index.ts"
+
+if [ ! -f "$STATUS_EXT/index.ts" ] || [ ! -f "$WEB_FETCH_EXT" ]; then
+  echo "[FAIL] Orquestra Pi extensions are not installed in this project." >&2
+  echo "       Run: /path/to/orquestra/scripts/install.sh $ROOT" >&2
+  exit 1
+fi
+
+if [ ! -f "$ENGRAM_EXT" ]; then
+  echo "[FAIL] gentle-engram is required for Orquestra memory." >&2
+  echo "       Install gentle-engram, then run this script again." >&2
+  exit 1
+fi
+
+exec pi --no-extensions --no-skills -e "$ENGRAM_EXT" -e "$STATUS_EXT" -e "$WEB_FETCH_EXT" "$@"