Feat/kiro cli executor with tool usage

[perezjoseph]

feat: Add Kiro CLI executor backend with tool usage logging

Summary

Adds a new executor backend (kiro-cli) that runs Shannon agents via the Kiro CLI in headless mode, as an alternative to the Claude Agent SDK. Includes per-invocation tool usage tracking exposed through a Temporal workflow query.

Changes

Kiro CLI Executor (apps/worker/src/ai/kiro-cli-executor.ts)

• Full executor implementation: agent JSON generation, subprocess spawning, exit code mapping, error classification
• Generates .kiro/agents/<name>.json with model, prompt, MCP servers, and hooks
• Heartbeat signaling to prevent Temporal activity timeouts during long-running agents
• Credits extraction from kiro-cli stderr output
• Structured output support via prompt augmentation (queue-writing instructions for vuln agents)
• Tool usage logging via pre/post hook scripts that write JSONL

Tool Usage Tracking

• Hook scripts capture every tool invocation (pre + post events) to ~/.kiro/agents/tool-usage.jsonl
• readAndLogToolUsage() parses JSONL and returns both summary and per-invocation records
• Workflow query getToolUsage accepts optional detailed boolean arg:
  • false (default): returns Record<string, ToolUsageSummaryMetrics> (counts, failures)
  • true: returns Record<string, DetailedToolUsageMetrics> (includes invocations[] with tool name, timestamp, success)
• Cumulative tool invocations/failures exposed as Temporal search attributes

CLI Credential Validation

• validateCredentials() now recognizes SHANNON_EXECUTOR_BACKEND=kiro-cli and only requires KIRO_API_KEY
• buildEnvFlags() excludes conflicting Bedrock/Vertex env vars when kiro-cli backend is active
• Worker preflight (preflight.ts) has matching kiro-cli bypass

Dockerfile

• Installs kiro-cli binary in builder stage via official installer
• Copies binary to runtime stage

Infrastructure

• Agent JSON supports MCP server configuration, custom hooks, and model tier resolution
• Global agents directory (~/.kiro/agents/) used for writable hook scripts inside Docker (repo mounted :ro)
• Playwright skill installation for browser-based testing agents

Configuration

# .env
SHANNON_EXECUTOR_BACKEND=kiro-cli
KIRO_API_KEY=ksk_your_key_here

Querying Tool Usage (Temporal)

# Summary (default)
temporal workflow query \
  --workflow-id <id> \
  --name getToolUsage \
  --address localhost:7233

# Detailed (per-invocation records)
temporal workflow query \
  --workflow-id <id> \
  --name getToolUsage \
  --input 'true' \
  --address localhost:7233 \
  --output json

Testing

• Full 5-phase pipeline scan against a live target (10 agents, 2394 tool invocations tracked)
• Verified getToolUsage query returns correct data in both summary and detailed modes
• Build passes (pnpm run build, pnpm run check)