agent: end-to-end gRPC Generate with delta-based session orchestration

Wires the client side of the new salience protocol so inference
actually runs over gRPC instead of emitting the stubbed "not yet
wired" error. Each turn walks the AST as interleaved chunks, sends
only what's new to the server, and streams decode tokens back.

context.rs:
  * `WireChunk` enum: `Tokens(Vec<u32>)` or `Image { bytes, mime,
    known_expanded_len }`. Preserves text/image/text ordering the
    wire path can't flatten.
  * `wire_chunks(range, skip)` walker, parallel to `wire_prompt` —
    branches emit `<|im_start|>…<|im_end|>` tokens, image leaves
    emit a single Image chunk (no inline vision tokens).
  * `NodeLeaf::set_image_token_count(n)` + recompute of cached
    `token_ids`; `ContextState::commit_image_token_counts(&[u32])`
    fills in the first-N zero-count image leaves in wire order.
  * `ResponseParser::run` handles the new
    `StreamToken::ImageAppended` by committing the server's N into
    the AST before the final Generate's Token events stream in.

salience.rs:
  * `SessionHandle` tracks `committed_len`. `append_image` advances
    it from the RPC response. New `generate(req)` opens the
    server-streaming RPC.

api/mod.rs:
  * `stream_session_mm(session_lock, chunks, sampling, priority,
    readout_shape)` replaces the stub. Spawns `run_session_generate`.
  * `run_session_generate`: takes the session out of the Mutex (or
    opens fresh), skips chunks covered by `committed_len` (bails on
    mid-chunk straddle or unknown-length image in the committed
    prefix), walks the delta: accumulates Tokens into `pending`, on
    Image flushes pending via `flush_pending` (max_tokens=0 Generate
    that just prefills), then AppendImage + emits
    StreamToken::ImageAppended. Final Generate carries any trailing
    pending text as `append_tokens` and the sampling params; Token
    events stream out as StreamToken::Token, Done as
    StreamToken::Done. On success, handle with updated
    `committed_len` returns to the Mutex; on error, handle drops
    and next call reopens.
  * `StreamToken::ImageAppended { placeholder_count }` variant —
    emitted in wire order before the final Generate's tokens.
  * Prefix-cache cap for readout coverage: `readout_ranges` covers
    `[prompt_len_after_append, u32::MAX)` when the caller provides
    a readout_shape, so decode positions stream their readouts.

agent/mod.rs:
  * `assemble_prompt` returns `Vec<WireChunk>` with the assistant
    prologue merged into the trailing Tokens chunk. Caller in
    `turn` passes chunks + readout_shape (pulled from
    `agent.readout.lock().manifest`) to `stream_session_mm`.
  * Dropped `assemble_prompt_tokens` — dead.

mind + unconscious:
  * `Unconscious::new(client)` stores a shared `ApiClient`. Fixes
    the repeated-manifest-fetch bug caused by each subagent's
    `ApiClient::new` having its own OnceCell. The client's Arc-
    wrapped manifest cache is now shared across every agent Mind
    spawns.
  * `prepare_spawn(name, auto, wake, base_client)` clones the base
    client and overrides `.model` for the resolved backend instead
    of constructing fresh. All three callers
    (`toggle`/`trigger`/unconscious loop) pass `self.client.clone()`.
  * `Mind::new` passes `agent.client.clone()` into
    `Unconscious::new`.

subconscious/generate.rs:
  * gen_continuation switched to `wire_chunks` + the new
    `stream_session_mm` signature. Ephemeral session opens on each
    call, tears down at scope end. No readouts requested.

Not changed yet, noted for follow-up:
  * Subconscious ablation scoring in learn.rs still talks to
    `/v1/score` over HTTP. Will migrate once we have time to verify
    the Generate+max_tokens=0+prompt_logprobs path end-to-end.
  * compare.rs constructs its own ApiClient for the
    `compare.test_backend` (which is intentionally a different
    endpoint) — left alone.
  * Readout manifest still fetched via HTTP at Agent::new.
    Migration to GetReadoutManifest gRPC is a separate cleanup.

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/agent/api/salience.rs

@@ -145,12 +145,14 @@ pub async fn append_image(
 /// Handle to a server-side session. Carries the id + connection params
 /// so subsequent per-session RPCs (AppendImage, Generate, ForkSession)
 /// can be issued without the caller juggling base_url / api_key each
-/// time.
+/// time. `committed_len` tracks the server's current session.tokens
+/// length so the client can submit deltas with the right `offset`.
 pub struct SessionHandle {
     pub session_id: String,
     pub max_model_len: u32,
     pub base_url: String,
     pub api_key: String,
+    pub committed_len: u32,
 }
 
 impl SessionHandle {
@@ -168,6 +170,7 @@ impl SessionHandle {
             max_model_len: resp.max_model_len,
             base_url: grpc_url,
             api_key: api_key.to_string(),
+            committed_len: 0,
         })
     }
 
@@ -175,25 +178,44 @@ impl SessionHandle {
         close_session(&self.base_url, &self.api_key, &self.session_id).await
     }
 
-    /// Append an image via the server-side vision block. See
-    /// `append_image` free function for full semantics.
+    /// Append an image via the server-side vision block. Updates
+    /// `committed_len` from the server's response on success.
     pub async fn append_image(
-        &self,
+        &mut self,
         data: Vec<u8>,
         mime: String,
-        offset: u32,
         truncating: bool,
     ) -> Result<pb::AppendImageResponse> {
-        append_image(
+        let resp = append_image(
             &self.base_url,
             &self.api_key,
             &self.session_id,
             data,
             mime,
-            offset,
+            self.committed_len,
             truncating,
         )
-        .await
+        .await?;
+        self.committed_len = resp.total_length;
+        Ok(resp)
+    }
+
+    /// Open a gRPC Generate stream with the given request. Caller
+    /// iterates the returned stream of GenerateEvents; the handle's
+    /// `committed_len` is advanced on Done based on the Done event's
+    /// `total_tokens` field.
+    pub async fn generate(
+        &self,
+        req: pb::GenerateRequest,
+    ) -> Result<tonic::Streaming<pb::GenerateEvent>> {
+        let mut client = connect(&self.base_url).await?;
+        let mut req = tonic::Request::new(req);
+        with_auth(&mut req, &self.api_key);
+        let resp = client
+            .generate(req)
+            .await
+            .with_context(|| "Generate RPC failed")?;
+        Ok(resp.into_inner())
     }
 }