feat(newos4): maintenance agent channel — triage engine, two-way replies, cron

- scripts/newos4-triage.py: deterministic collector (records vs occurrences, real vs
  noise vs self-referential, new reports since last run, checker WARN/FAIL). Untrusted
  strings are sanitised and prefixed DATA| before they can reach an agent prompt;
  state + output written under flock with mode 644.
- scripts/newos4-reply.py: appends one reply to data/maintenance/replies.json under
  flock. Hermes writes here instead of POSTing with an admin cookie, so an expired
  session can never look like a delivered reply.
- api/debug/agent-replies.php: GET/POST (admin-gated by nginx) half of the thread.
- api/debug/report.php: accepts thread + kind=maintenance so in-app feedback is
  distinguishable from operator bug reports.
- terminal: `feedback <message>` and `feedback-inbox` commands; help.html rows added
  (help coverage 357/357, modules-index regenerated).

Live proof: `feedback "…"` filed RPT-20261023-123825-781fba86 with thread
thr-glmfwae2 and kind=maintenance; agent-replies GET returned the posted reply, POST
returned 201; triage first run reported 9 new reports, second run 0.
Cron: newos4-maintenance (7e3b326daa4c) daily 07:15, newos4-skills-weekly
(cb6bc2a16216) Mondays 06:30.

1 files changed, 9 insertions, 0 deletions

diff --git a/api/debug/report.php b/api/debug/report.php
index cefcae6..5d4fc95 100644
--- a/api/debug/report.php
+++ b/api/debug/report.php
@@ -29,6 +29,13 @@ $body = (string)($payload['body'] ?? '');
 if (mb_strlen($body) > 4000) $body = mb_substr($body, 0, 4000);
 $diag = (isset($payload['diagnostics']) && is_array($payload['diagnostics'])) ? $payload['diagnostics'] : [];
 
+// Maintenance thread: lets the in-app agent and the Hermes maintenance job hold a conversation.
+// `thread` is a client-generated id (thr-xxxxxxxx); `kind` distinguishes agent feedback from
+// operator bug reports so triage can weight them differently.
+$thread = preg_replace('/[^a-zA-Z0-9_-]/', '', (string)($payload['thread'] ?? ''));
+if (mb_strlen($thread) > 40) $thread = substr($thread, 0, 40);
+$kind = (($payload['kind'] ?? '') === 'maintenance') ? 'maintenance' : 'user';
+
 // Storage guard: data/ is not writable by php-fpm, so never pretend we wrote a report.
 if (!is_dir(REPORTS_DIR)) @mkdir(REPORTS_DIR, 0775, true);
 if (!is_dir(REPORTS_DIR) || !is_writable(REPORTS_DIR)) {
@@ -85,6 +92,8 @@ $record = [
     'title' => $title,
     'body' => $body,
     'diagnostics' => $diag,
+    'thread' => $thread,
+    'kind' => $kind,
     'meta' => [
         'ip' => $ip,
         'ua' => $_SERVER['HTTP_USER_AGENT'] ?? '',