fix: OOM on cold parse (V8 SlicedString retention) + kiro projectPath for repo attribution - #984

Summary

Two related fixes for the kiro provider and shared parser, ordered deliberately (see "Landing order" below):

1. fix(parser): cold-parse OOM caused by V8 SlicedString retention in the session cache
2. fix(kiro): emit the session's full working directory as projectPath so codeburn yield and sync push --attribution (feat(sync): opt-in git attribution spans on sync push --attribution #848) can resolve kiro sessions to their git repos

1. The OOM

codeburn sync push --since=all (and any cold parse of a large kiro store) crashed with
FATAL ERROR: Ineffective mark-compacts near heap limit at V8's default ~4GB heap.

Root cause: String.prototype.slice returns a V8 SlicedString — a view that retains a
reference to its entire parent string. The parsers store short previews of message text
(userMessage.slice(0, 500/2000)) in the long-lived session cache. Kiro CLI session entries
routinely carry 100KB+ strings (agent-injected system prompts, tool results), so every cached
preview pinned its full parent buffer for the life of the process.

Measured on 3.2GB of kiro CLI session files (6,659 files, largest 40MB):

Warm runs were always fine (~0.29GB) because the cache's JSON round-trip flattens strings on
load — which made the bug look intermittent: it only fired on a cold or invalidated cache.

Fix: flatSlice(s, max) (bounded prefix as a flat copy via Buffer round-trip) and
flatString(s) (unconditional flat copy, for short strings that are views — regex match
groups and trim() results). Applied at the six kiro userMessage capture sites, the three
shared cache-build sites in parser.ts (protects all providers), the title/agentType
trim().slice() sites, and extractToolNames (regex match groups retain the entire scanned
content buffer).

2. kiro projectPath

The kiro provider read the full working directory from session metadata (meta.cwd for CLI
sessions, workspacePaths[0] for v2 IDE sessions, workspaceDirectory for workspace
sessions) but discarded it via basename(), keeping only the leaf name for display. Repo
grouping in yield.ts therefore never resolved kiro sessions to a git repo — codeburn yield
misgrouped them under the cwd fallback, and sync push --attribution produced 0 facts for all
kiro sessions. On my machine this fix took a 6-month attribution window from 59 to 318 facts.

Behavior changes to be aware of:

• kiro calls now flow through worktree canonicalization: sessions in linked git worktrees
  report under the main repository's project name (consistent with claude/codex)
• workingDirectory is now populated on kiro calls
• PROVIDER_PARSE_VERSIONS.kiro is bumped (project-path-v1): cached entries predate
  projectPath and are served without re-invoking the parser, so without the bump this fix
  silently no-ops for every warm cache. Upgrading triggers a one-time cold kiro re-parse.
• resolveCanonicalProjectPath is now memoized on cwd (kiro's per-call canonicalization
  measured ~+5% cold parse before memoization; the same cache benefits all providers)

Landing order (important)

The version bump forces a cold kiro re-parse on upgrade — exactly the workload that OOM'd
before commit 1. These commits must land together, in this order. Please don't split or
reorder them.

Tests

• tests/flat-slice.test.ts: prefix/identity/multi-byte behavior, a pinned decision for
  mid-surrogate-pair cuts (U+FFFD), and heap-growth property tests proving no parent retention
  for both flatSlice and regex-match flatString
• tests/kiro-projectpath.test.ts: projectPath emission fixtures for all three kiro session
  formats (CLI, v2 IDE, workspace-session), a fingerprint-change assertion, and a regression
  test seeding a pre-bump cache entry and proving the re-parse recovers projectPath
• tsc clean; kiro/sync/yield/parser suites pass (178 tests)