[mikemikimike]

Fixes #1092

#1092

Skip project-scoped model-judge configuration for untrusted projects and warn the user. Refresh the configuration when trust changes before an agent turn, including when a project-only judge becomes available or must defer.

Tests:

• pnpm --filter @gotgenes/pi-permission-model-judge run test (78 passed)
• pnpm run check
• pnpm run test (fails on Windows in existing process and path tests; reproduced on the base commit)

[gotgenes]

@mikemikimike Thanks for picking this up.
I landed the same fix on main in parallel (a6c381a, cb26da5, 3a6177a), released in pi-permission-model-judge 5.0.0, so this PR is superseded and I'm going to close it.
One difference: this PR also refreshes the config when trust changes before a turn, while main reads trust once at session_start.
If you've seen trust change mid-session without a new session_start, that would be worth its own issue.