Pi client that runs the CLI through an AgentHarness.Exec implementation instead of a local port.

The pi RPC protocol — JSONL framing, prompts, dialogs — stays on the orchestrator; the pi --mode rpc process itself runs wherever the configured exec module puts it: locally through AgentHarness.Exec.Local, or in a remote sandbox through an exec implementation provided by the application.

Select it per session with auth: :inherit (the fail-closed :subscription mode depends on local pi /login state by design):

provider_options: %{
  auth: :inherit,
  exec: {MyApp.SandboxExec, sandbox: sandbox}
}

Differences from Client.Port

• The executable resolves in the execution environment, not against the orchestrator's PATH.
• cwd and env are interpreted where the command runs; nothing in the spawn spec refers to the orchestrator's filesystem.
• stderr stays out of the data stream (:passthrough), as merging it would corrupt pi's JSONL protocol. Where it surfaces is up to the exec implementation.
• verify_subscription_auth/2 is refused: subscription auth inspects local credential state that has no meaning for a remote process.