feat(llm): stream LLM responses (default off)

[maxie7]

What

The LLM stage is request/response: the card says "explaining…" for the whole generation, then flips to fully explained in one step. This adds SSE streaming so the card's fields appear as the model completes them.

It is progressive display only — the final explanation is byte-identical, and the authoritative parse is unchanged. Default off: provider behaviour around stream + response_format varies enough that a regression in the explanation path would be worse than a card that feels slower. Enable with --llm-stream.

This closes Epic M7.

How

The parser was already most of the way there. decodeObject streams JSON tokens and stops at the tear — it was written for max_tokens truncation, and a partial stream is the same shape. So partialExplanation is parseExplanation minus the prose fallback, and progressive display cannot drift from the finished answer because it is the same code on the same bytes. stripFences already tolerated a fence or a prose preamble, so json-mode-off still streams progressively.

Progressive display is content-driven, not flag-driven: the extractor runs over the accumulated buffer and surfaces only completed field values. A model answering in prose simply produces no intermediate updates. Raw buffer text, a half-written field, a fence or a preamble never reach the card.

Updates fire on field completion, not on a tick — at most three per escalation, since the card renders three fields. No clock, so the tests stay deterministic.

The partial send drops rather than blocks. A blocking send would park the worker while the HTTP body is open, so a busy pipeline goroutine under a log flood would stall the SSE read path, trip our own --llm-timeout, and badge a perfectly good answer as incomplete. A partial is superseded by the next one and then by the authoritative result, which stays on the existing blocking path and is never dropped. This matches what the codebase already does for cosmetic updates.

The concurrency model is unchanged: no new locks, the pipeline goroutine remains the sole writer of the template map, -race green.

Getting the failure cases right

Most of the work here was in not reporting a good response as a broken one.

• Byte limits sized for SSE framing. Every token arrives wrapped in a full chunk envelope (~246 bytes), so a 4096-token answer is ~984 KiB — within 4% of the old 1 MiB cap meant for a complete JSON body. A normal response would have tripped it and been retried and badged incomplete. The wire and the accumulated content now have separate budgets.
• io.LimitReader plus explicit counting. The reader bounds memory (a provider streaming without newlines would otherwise buffer unboundedly); the counter is what distinguishes our limit from their close, since exhausting a LimitReader surfaces as a plain io.EOF.
• Deterministic tears are not transient. Our own --llm-timeout and a byte-limit overrun both reproduce exactly on a second attempt — retrying buys nothing and burns a full extra generation. Both go straight to salvage.
• A tear after the closing brace is not a tear. If the JSON object closed, the answer arrived; it is returned complete and unbadged, with no retry.
• A salvaged card is marked answer incomplete, and the status line reads explaining… for the whole stream — a card showing a summary while reading as finished would be dishonest.
• finish_reason: length stays a separate path, so the reasoning-model diagnostic naming --llm-max-tokens is preserved.
• Split placeholders are closed by construction: a field is emitted only once its closing quote is consumed, so an anonymizer placeholder inside an emitted field is necessarily whole.

Two bugs surfaced while writing the tests: a stream torn before its first field completed was salvaging through the prose fallback (so {"summ would have rendered as the summary), and the closed-object check had to move ahead of the tear check or a complete answer burned the retry budget first.

Also in this PR

• chore(ci): go test -race ./... added to CI and to the verify skill — the concurrency model is load-bearing and nothing was checking it automatically. The timing-sensitive tests were audited first (full -race suite ~16s; stressed clean at tui ×10, llm/pipeline/ingest ×15, coalescer ×30); one test needed a wider margin.
• examples/logscry.yaml gains stream, and the anonymize / anonymize_suffixes keys that were missed in the v0.4.0 anonymization work.

Verification

• gofmt, go vet, golangci-lint (0 issues), go test ./..., go test -race ./..., go build ./... — all green.
• Adversarial SSE chunking: boundaries mid-JSON-token, several events per read, keep-alives, \r\n, malformed payloads, a final line with no trailing newline, a newline-free runaway.
• Three tests were verified to fail without their fix, since a test that would pass anyway is worthless.
• Manual: against a fake SSE provider the card fills in field by field; the same content non-streamed yields a byte-identical final explanation; --plain prints exactly one ESCALATED: and one EXPLAINED: block.