feat: bridge generic provider calls to authoritative sessions

[rjcloudsigma]

Summary

• correlate public model_call_started session identity to generic CloudSigma provider invocations using the exact W3C trace/span
• cover Kimi and other generic OpenAI-compatible CloudSigma models without OpenClaw core changes
• retain strict identity precedence and fail closed for malformed, absent, conflicting, or ambiguous trace data
• use a bounded 1,024-entry bridge with a 30-minute sliding TTL
• expose privacy-safe bridge outcome counters through taas.affinity.stats
• bump plugin to v0.11.0

Safety

• no agent/workspace/timing/global-current-session fallback
• parent and subagent sessions remain distinct
• retries and concurrent calls on one exact trace do not race
• successful exact matches refresh TTL; TaaS owns the independent seven-day affinity lifetime
• counters expose totals only: hit, miss, expired, ambiguous, and direct options-session usage
• hook support is feature-detected for non-breaking OpenClaw upgrade compatibility

Verification

• npm test: 38/38 tests passed
• TypeScript typecheck and smoke tests passed
• npm run build passed
• npm pack --dry-run passed
• git diff --check passed
• built-plugin compatibility validated against Snowcrash OpenClaw 2026.7.1-2 and its queued lifecycle-hook ordering

Deployment gate

This PR changes the repository only. Snowcrash remains on plugin v0.10.0 until separately approved.