Add first-class Kimi K3 support through Fireworks

What changed

Added a first-class Pi preset for Kimi K3 on Fireworks, including offline model registration, local and sandbox credential routing, regression coverage, and setup/model documentation.

Why

Pi's bundled Fireworks catalog predates Kimi K3, so using fireworks/accounts/fireworks/models/kimi-k3 currently requires every user to maintain a private models.json entry. This compatibility overlay makes the model work with only FIREWORKS_API_KEY, preserves existing Fireworks models and explicit overrides, and becomes a no-op when a future Pi catalog includes the model.

Verification

• pnpm test passes — 2,256 tests passed, 1 credential-gated live-sandbox test skipped
• pnpm lint passes
• pnpm knip passes
• pnpm test:bundle passes — 23 tests
• pnpm test:e2e passes — 29 tests, 1 credential-gated live-sandbox test skipped
• pnpm validate passes
• Live Fireworks smoke passed without a Pi models.json

The final live smoke processed one intentionally vulnerable fixture with Kimi K3 at low thinking and concurrency 1. It completed one tool-using analysis in 23.4 seconds, returned four findings, recorded 3,426 input / 869 output tokens at $0.0239274, produced no refusal or parse failure, and did not persist the Fireworks credential.

Notes for reviewer

The preset is exact-model scoped and does not change any default model. It merges Kimi K3 into Pi's existing Fireworks catalog only when the model is missing, preserves an existing exact-model custom endpoint, retains explicit base URL/key/header overrides, and sends sandbox workers only a placeholder token while the firewall injects the real credential on api.fireworks.ai.

Model metadata and pricing follow the Fireworks Kimi K3 listing; the endpoint follows Fireworks' OpenAI compatibility documentation.