ai: contain Kiro ACP stream failures and empty responses

[anders-heimer]

Summary

This PR adds Kiro-specific containment and diagnostics for ACP session/prompt
failures.

The Kiro backend can fail or stall while Sashiko is waiting for the long-lived
ACP prompt response stream. In earlier reviews this showed up as repeated
JSON-RPC -32603 Internal error responses wrapping Kiro/upstream response-stream
failures such as reqwest::Error { kind: Body, source: TimedOut } and
UnexpectedEof. Those errors were retried as generic transient provider errors,
which allowed a single expensive Kiro turn to monopolize a review worker through
many retries.

This series keeps the retry containment scoped to the Kiro ACP backend. Other AI
providers keep the existing generic retry behavior.

Changes

• Improve Kiro ACP diagnostics around:

  • initialize
  • session/new
  • session/prompt
  • prompt duration
  • chunk count
  • response length
  • ACP JSON-RPC line count
  • max idle gap between valid ACP JSON-RPC lines
  • malformed stdout/stderr previews
  • redacted JSON-RPC error.data
  • provider request IDs when present

• Classify known Kiro ACP stream/provider failures as transient, including
  response-stream errors, response body errors, stalled-stream/minimum-throughput
  failures, TimedOut, and UnexpectedEof.

• Preserve rate-limit precedence over generic stream-transient classification, so
  throttling wrapped in a stream-looking error still follows the rate-limit path.

• Add a side-effect-aware retry gate for ACP prompt turns. If Kiro emits
  tool/action-like updates before an otherwise retryable failure, the error is
  treated as fatal rather than replaying a possibly non-idempotent turn.

• Add Kiro-only per-turn retry containment:

  • max transient attempts per logical turn
  • max same-error streak per logical turn
  • max wall-clock budget per logical turn
  • process-local Kiro circuit breaker
  • configurable Kiro-specific environment overrides

• Add a Kiro ACP idle watchdog based on valid ACP JSON-RPC stdout activity,
  rather than arbitrary stdout bytes. This avoids treating verbose/non-ACP Kiro
  diagnostics as protocol progress.

• Send ACP session/cancel when session/prompt read handling fails before the
  provider returns the error.

• Treat protocol-level successful Kiro turns with no model content as a distinct
  Kiro empty-response failure. Empty responses are retried only while the
  Kiro-specific empty-response budget allows it, and remain fatal after
  side-effect-looking ACP updates.

Configuration

The Kiro containment settings are configurable through environment variables:

SASHIKO__AI__KIRO_MAX_TRANSIENT_ATTEMPTS_PER_TURN
SASHIKO__AI__KIRO_MAX_SAME_TRANSIENT_STREAK_PER_TURN
SASHIKO__AI__KIRO_MAX_TURN_WALL_CLOCK_SECS
SASHIKO__AI__KIRO_ACP_IDLE_TIMEOUT_SECS
SASHIKO__AI__KIRO_CIRCUIT_FAILURE_WINDOW_SECS
SASHIKO__AI__KIRO_CIRCUIT_FAILURE_THRESHOLD
SASHIKO__AI__KIRO_CIRCUIT_COOLDOWN_SECS
SASHIKO__AI__KIRO_MAX_EMPTY_RESPONSES_PER_TURN