fix(agent): never leak raw reasoning as a reply; transport-aware prompt

[plombeer31]

What

Two-part fix for the reasoning-channel leak and the native_tools prompt contradiction reported in #285.

1. Guardrail — stop salvaging raw CoT as a reply (src/agent/step-executor.ts)

tryParseToolCalls's native_tools branch handled a reasoning-only completion (empty content, no tool_calls, non-empty reasoning_content) by wrapping the raw reasoning text into a reply { text } call — delivering the model's internal chain-of-thought verbatim as deliberate agent speech, exactly as the reporter's transcript shows.

Now:

• a GBNF-shaped [{tool, args}, ...] batch embedded in the think channel is still recovered as real tool calls (that path recovers genuine intent and is kept);
• anything else returns { ok: false }, routing the completion through the existing one-shot repair path (parse_retry event + buildToolCallRepairPrompt + REPAIR_MAX_TOKENS cap) that already handles every other unparseable body;
• a repair that fails too ends the step as a GrammarError — a normal parse error, never a CoT leak.

2. Root cause — transport-aware stable prefix (src/prompt/stable-prefix.ts + threading)

Under llm.toolTransport: "native_tools" the request carries an OpenAI tools array with tool_choice: "auto", while the prompt simultaneously ordered "Emit a JSON ARRAY of tool calls now" and the persona mandated "exactly one JSON array". The reporter measured 0/6 completions using native tool_calls under this dual mandate.

buildStablePrefix now takes toolTransport (threaded StepDependencies → BuildPromptInput → buildStablePrefix): under native_tools the persona's emission mandate and the ### instructions block switch to native function-calling guidance ("call tools through the function-calling interface; reply / plain text for the final answer").

The ### tools text catalog is deliberately kept in both modes: the provider fallback chain can hand a native-shaped request to a grammar-only llama-server link (see the buildLlmStreamParams comment about keeping grammar populated), and the catalog carries the tier / tool.view semantics. The JSON-array emission mandate was the contradiction, not the catalog.

Byte-stability

The grammar-path prefix is byte-identical to origin/main's output — verified by sha256-comparing buildStablePrefix from both revisions across variants (plain, reasoningSystemToken, Gemma-4 turnSystemOpen, maxParallelToolCalls, win32, custom systemPersona): all identical (fde2b2b9…). KV-cache reuse is unaffected for local models; within a session the transport is fixed, so the native prefix is byte-stable across turns too (pinned by a test).

Known caveat

On a native-to-grammar mid-session fallover the prompt lacks the JSON-array mandate while the grammar link parses GBNF. Acceptable: llama-server's GBNF grammar constrains decoding to the array shape regardless of the prompt mandate.

Test evidence

• Rewrote the pinned salvage test: native_tools: unparseable reasoning-only completion routes through parse_retry, never leaks CoT as a reply — asserts the repair round-trip and that no reply anywhere in the transcript carries the reasoning body.
• New: native_tools: recovers a GBNF-shaped batch embedded in reasoning_content without a retry (salvage of real tool calls is preserved).
• New: native_tools: reasoning-only on both attempts surfaces a parse error, not the CoT (rejects with GrammarError).
• New buildPrompt tool transport (issue #285) block: native prefix omits both text-JSON mandates but keeps ### tools; grammar prefix byte-identical whether the field is omitted or explicit; native prefix byte-stable across turns; explicit systemPersona override wins on both transports.
• Without the fix, the two leak tests and the native-prefix test fail (verified by stashing the src changes); with it, all pass.
• npm run lint clean. Full suite: 610/611 files, 6436 passed / 1 failed — the one failure (src/sidecar/send-message-concurrency.test.ts) fails identically on pristine origin/main @ 4caff55 and is unrelated to this diff.

Fixes #285