fix(kimi): capture replies from kimi-code native wire logs; gate pane fallback

[agnitum2009]

Problem

The kimi native turn observer looks for wire logs only under the legacy layout ~/.kimi/sessions/<md5(workdir)>/<session>/wire.jsonl. The current kimi-code runtime writes them to ~/.kimi-code/sessions/wd_<basename[:40]>_<sha256(workdir)[:12]>/<session>/agents/<agent>/wire.jsonl, so the native observer never fires: every kimi job falls back to pane scraping. In production (8-agent CCB deployment, 2026-07-18/19) this caused:

• 8+ completion replies delivered as truncated pane transcripts with the actual verdict cut off (TUI collapse markers, ... (N more lines, ctrl+o to expand), tool-output chrome),
• 3 large-scan jobs failed with empty replies (kimi_native_turn_timeout, reply_chars=0) even though the full replies existed in the provider wire logs.

Two further issues surfaced while fixing this:

1. Multiple kimi agents sharing one work_dir share one sessions root, so a req_id mentioned in another agent's prompt could win the observation (wrong session).
2. Even with the wire path fixed, the pane fallback could still override an in-progress native turn: the pane looks input-ready/stable during answer generation, so a premature snapshot truncated the reply.

Fix

lib/provider_backends/kimi/native_log.py

• Add the kimi-code sessions layout alongside the legacy .kimi layout (kimi_code_project_dirname, kimi_code_sessions_root, glob */agents/*/wire.jsonl); hash/naming rule verified against real session dirs.
• Detect turn completion from context.append_loop_event/step.end with finishReason != tool_use (kimi-code wire logs have no TurnEnd), plus a finalize-on-next-turn-start safety net.
• Strict-then-loose req_id matching: prefer turns whose prompt carries the CCB_REQ_ID: <id> header (fixes cross-agent session confusion); plain substring matching kept as fallback for legacy prompt formats.
• Fix session_id extraction for the <session>/agents/<agent>/wire.jsonl layout.

lib/provider_backends/kimi/execution.py

• Pane fallback is now rescue-only (used only when the native observation is None); it can no longer replace an anchored but still-running native turn.

Validation

• Offline against real production wire logs: 4/4 incident req_ids resolve to the correct session, completed=True, with clean verdict-first reply text — including the 3 jobs that had failed empty (their 1.3–1.5 KB replies were in the wire logs all along).
• Regression: legacy TurnBegin/TurnEnd layout still completes; thinking parts (part.think) are excluded from the reply; an in-flight turn (no step.end yet) stays not-completed.
• Live A/B on a production daemon: replay on the build with only the native_log fix still delivered pane-truncated junk; after the execution.py gating fix, the same review-style ask delivered verdict: PASS + full verdict block at the top with zero transcript prepending (job_7567cc588895). All 8 agents healthy after restart, no lost jobs.

Notes

• No state-format changes; rollback = revert these two files.
• Patch applies byte-clean on upstream/main at 5214ce0 (post-v8.2.1).