fix: carry agent identity so TaaS accepts caller session ids

[rjcloudsigma]

Problem

TaaS was discarding every caller-supplied session identity and minting its own UUID per request. Production logs showed 76/76 requests with:

[CC_OPENCLAW_IDENTITY] declared_plugin=false identity_present=false
fallback_reason=missing_agent_and_session

Consequences measured in production:

• 746 session bindings for 458 requests (0.6 requests per binding) — a new affinity session minted per request instead of reuse
• Session affinity effectively disabled: requests scattered across Claude Code nodes
• Continuity metric pinned at ~0% (cont:hit had zero keys cluster-wide)

Independent evidence that continuation was real: prompt-cache reads averaged 47.6%. A cache read is only possible when a provider recognises a prefix from an earlier request, so upstream providers recognised these conversations while TaaS did not.

Root cause

TaaS trusts a caller identity only when both parts are present:

identity_present = session_present and agent_present

Two independent gaps meant neither part arrived:

1. The header path never executes for this provider. X-Session-Id is emitted from resolveTransportTurnState, but OpenClaw only invokes that hook from the Responses transports. CloudSigma is configured api: "openai-completions", and createOpenAICompletionsTransportStreamFn contains zero turnState references. The headers were correct but never attached on our lane.

2. The body path that does execute omitted the agent id. onPayload → patchPayloadMetadata runs on the completions transport and injected session_id / sticky_key, but agent_id was only set when deriveAgentIdForCapture could infer it from agentDir/workspaceDir/env — unavailable in this path, so it returned null.

Fix

Add resolveAgentIdentity, which prefers the existing directory/env derivation and otherwise extracts the agent segment from OpenClaw's own session key (agent:<agentId>:<scope>). Used at both the wrapper and transport call sites, so the correlation envelope always carries a complete identity.

The value only needs to be stable for the conversation, not globally unique. When there is genuinely no session identity, it still returns null rather than fabricating one.

Verification

Built output, exercising the real code path:

agent from session key: main
correlation: {"session_id":"agent:main:main","agent_id":"main",
              "source":"openclaw-taas-affinity","plugin_version":"0.7.0"}
TaaS would compute -> declared_plugin: true  identity_present: true

Both flags flip from false to true — precisely the production failure.

• 11/11 tests pass (7 existing + 4 new in test/agent-identity.test.ts)
• Typecheck clean
• Version 0.6.0 → 0.7.0, smoke assertions updated

Expected impact

Session affinity should begin pinning conversations to their bound node, which should raise both continuity reporting and real prompt-cache hit rates.