#19 producer-side rollout requirements: stamp event_id and forward the correlation id

[jamditis]

The consumer side of #19 shipped: the bridge reply parser tolerates an optional event_id token in a block header and matches a reply to its request by identity when present, falling back to the positional cursor when absent. No producer stamps the token yet, so the identity path is dormant and the positional path runs. Closing #48 (the dropped-reply blast radius) needs the producer side.

Two coupled requirements, both surfaced by a Codex 5.5-high review of the consumer PR and verified against the code path as load-bearing for the mixed/transition rollout window:

1. Forward the bridge's correlation id through the real transports

brain_via_bridge generates an event_id per turn and passes it to the SendFn. cli_send and ssh_cli_send accept it but do not forward it yet, because bot-spren has no --event-id flow. When the producer starts stamping, the reply must echo the bridge's id, not an id bot-spren mints on its own. Otherwise the reply carries a non-matching event_id, identity match fails, and because the positional fallback only accepts unstamped blocks, the stamped reply times out instead of being spoken. So the producer step must add bot-spren send --event-id <id> (or equivalent) and wire cli_send / ssh_cli_send to pass it through.

2. Handle late non-matching stamped blocks in the mixed window

During rollout, replies are mixed stamped and unstamped. If a stamped turn times out and its reply lands late, the late stamped block can sit at a later unstamped turn's positional target. The positional fallback inspects only blocks[target], so it skips the stamped block (correctly, by the unstamped-only rule) but does not scan forward to the unstamped reply at the next slot, so that turn times out and the next unstamped turn can fall one answer behind: the #48 lag, relocated. The fix is for the positional fallback to scan forward past identity-claimed (stamped) blocks to the first unstamped block at or after target, realigning the cursor to it. This needs end-to-end tests against the real stamped producer, not just stubs, which is why it belongs with the producer step rather than the consumer PR.

Ownership

The bot-spren / FileOutbound side is syl-spren on officejawn, a shared and live session, so the producer change needs deconfliction before it lands.

[jamditis]

Cloud review of PR #60 surfaced a third facet of this mixed-window work, folded in here.

The consumer deliberately does NOT realign the positional cursor on an identity match. Realigning it (e.g. to the matched block's index) would have to rewind the cursor past slots reserved for earlier timed-out sends, and positional correlation cannot tell a dropped reserved slot from a merely late one. Rewinding could therefore let a late legacy reply be spoken as the next turn's answer, breaking the invariant that a late reply fills its own reserved slot and is skipped.

So requirement 2 (mixed-window handling) is unsolvable in the consumer alone: a stamped identity match followed by an unstamped positional fallback turn cannot keep the cursor coherent while preserving the late-reply invariant. The producer step closes it by stamping every reply, which removes the unstamped fallback path entirely. Until then the gap is documented and tested -- the transition test in test_brain_bridge.py asserts the unstamped-after-stamped turn strands, tracked here.