feat(wake-slo): recipient-side responder for WAKE_SLO_PROBE_* topics

[askhatsoltanov1984-lang]

Summary

Short-circuit AgentComm wake-push payloads matching the Wake SLO probe protocol before the heavy Claude session spawns. The responder acks + replies via the local Qoopia MCP endpoint, so the wake SLO metric measures wake-push transport + recipient-side dispatch rather than LLM session liveness.

Why recipient-side (not sender-side)

A sender-side responder synthesises the pong locally and fakes L2/L3/L4 proof — the sender writes "the recipient acked" without the recipient process ever running. Leo R2 (2026-05-24) BLOCKed that design. This PR implements the responder where it has to live: in the recipient agent's wake handler, so the ack + reply genuinely originate from the recipient.

Mechanism

• ductor_bot/wake_slo_responder.py: new module. Probe detection is a strict topic + body regex pair (^WAKE_SLO_PROBE_(C2L|L2C)_\d+\$ and ^WAKE_SLO_PING <iso-ts>\$). On match, the module POSTs two JSON-RPC calls to \$QOOPIA_PUBLIC_URL/mcp (stateless mode): agent_ack(message_id, status='auto_pong') then agent_reply(session_id, body='WAKE_SLO_PONG <echoed-ts>', close=true). Stdlib urllib.request only — no new dependencies.
• ductor_bot/webhook/observer.py: in _dispatch, immediately after the hook is resolved, check hook.mode == 'wake' && is_probe_payload(payload). If yes, call respond(). On status: ok return a WebhookResult with status='success:wake_slo_probe' and skip the Claude dispatch. On any error the dispatch falls through to the normal wake path, so a broken responder never silently drops real payloads.

Auth (deployment note)

agent_ack is gated on auth.agent_id == message.recipient_agent_id. The responder must therefore authenticate as the local recipient agent. Sourcing precedence (highest first):

1. WAKE_SLO_RESPONDER_API_KEY (raw value)
2. WAKE_SLO_RESPONDER_API_KEY_FILE (path)
3. QOOPIA_API_KEY_FILE (path; back-compat)
4. Default ~/.ductor-corsairmain/.secrets/qoopia_api_key

On hosts where the default file holds a steward key, set the env override at deploy time to the recipient agent's own key, otherwise the responder logs a warning and falls through to the Claude path.

Tests

tests/test_wake_slo_responder.py — 9 tests covering: probe-payload regex (positive + 3 negative cases), api-key missing path, full ack+reply round-trip, ack-failure short-circuit, network-error fall-through, SSE-framed MCP response parsing.

9 passed in 0.09s

Integration test (corsair-main on Corsair, 2026-05-24): probe sent from Leo → corsair-main; fresh python process loading the new module with corsair-main's key wrote real ack + reply rows in <100ms; session closed via close=true. Real-DB evidence captured at /srv/qoopia/test-evidence/phase1-item-1-r3-2026-05-24T005244Z.log (Corsair-local).

Compatibility

• Builds on fix/claude-full-model-provider (PR Fix provider_for for full Claude model IDs #143 ancestor commit included).
• Stateless MCP confirmed via Qoopia code review (sessionIdGenerator: undefined).
• No new dependencies. No schema migration.
• Falls through to existing wake-handler on any responder error.

Test plan

• Unit tests pass (uv run pytest tests/test_wake_slo_responder.py).
• Integration test on Corsair (real Qoopia, recipient-side ack + reply written, session closed).
• Cross-host probe round-trip after Leo-side responder ships (out of scope for this PR).