fix: drop non-existent --print/--afk flags from the kimi CLI provider argv

[atomantic]

Summary

server/lib/kimi.js was written without a live kimi binary to check against, and the guesses were wrong in a way that broke the provider outright. Verified against kimi v0.32.0:

• --print is not an option (error: unknown option '--print' / (Did you mean --prompt?)). ensureKimiHeadlessArgs pushed it unconditionally, so every headless kimi-cli run exited at argv parsing before doing any work. Non-interactive mode is implicit in supplying -p/--prompt; there is no separate mode flag.
• --afk is not an option either (error: unknown option '--afk'), so it is gone from APPROVAL_FLAGS.
• The headless path takes no approval posture at all — kimi refuses to combine --prompt with --yolo/-y/--auto (error: Cannot combine --prompt with --yolo.) and runs unattended without one. ensureKimiHeadlessArgs now adds only --model <id> when a real model id is pinned. The interactive TUI path (no --prompt) keeps --yolo, which parses cleanly.

Prompt delivery is unchanged: -p, --prompt <prompt> takes the prompt as the flag's argv value, and no stdin or --prompt-file mechanism exists, so prepareKimiPrompt's useStdin: false splice is correct as shipped.

Also fixed: the seeds and already-deployed installs

Removing the injection alone would not have fixed anything deployed. The kimi-cli seed baked args: ["--print"] into data.reference/providers.json and server/lib/aiToolkit/defaults/providers.sample.json, and migration 201-kimi-providers shipped that same frozen def to existing installs. setup-data.js merges only missing provider entries and never updates existing ones, so a stored kimi-cli would have kept the fatal token forever.

• Both seeds now ship args: [] for kimi-cli.
• New migration 269-kimi-drop-nonexistent-flags strips --print / --afk from a stored kimi-cli / kimi-tui provider's args. Unlike the usual conservative rule (see 121-codex-tui-bypass-sandbox, which rewrites only an exactly-matching old default), this one removes the tokens wherever they appear, including from a hand-curated list — neither flag exists in the binary, so keeping one is never a valid user preference, it is a guaranteed startup failure. Every other arg is preserved in order.
• Migration 201's frozen def is left untouched as the historical record of what it installed; 269 sorts after it, so even a first-time run of 201 gets cleaned up in the same pass. Its header comment now says so.

Deliberately out of scope

• --output-format stream-json. It exists (--output-format takes text (default) or stream-json) and would let a pipeline stage parse discrete JSON events instead of scraping possibly-interleaved plain text, but no stage parses kimi's stdout programmatically today, so text stays the default. Noted in the file header rather than adopted.
• A providerUsage.js FAMILIES entry. kimi --help exposes no usage/quota command in this version (kimi provider list shows configured providers and model counts, not consumption), so there is nothing to hook up.

The remaining known limitation — a large prompt riding argv against Windows' ~32K limit / POSIX ARG_MAX — is now documented as confirmed rather than speculative: -p <value> is the only prompt mechanism kimi --help documents, so there is no lower-risk delivery to switch to.

Docs/comments updated alongside: the kimi.js header, cliProviderArgs.js's per-CLI convention table and prompt-dispatcher notes, and the server/lib/README.md catalog row.

Test plan

• cd server && NODE_ENV=test npm test — full server suite green (1387 files, 28935 tests passed, 26 files / 252 tests skipped for the usual Postgres gating).
• server/lib/kimi.test.js rewritten to assert the concrete corrected argv arrays rather than the old --print-bearing ones, plus:
  • a regression guard that ensureKimiHeadlessArgs never introduces --print, --afk, --yolo, -y, or --auto across a matrix of base args and model values;
  • a new "headless argv, end to end" block that composes ensureKimiHeadlessArgs → prepareKimiPrompt and spells out the full spawn-site argv, so a regression cannot hide behind two individually-plausible halves.
• scripts/migrations/269-kimi-drop-nonexistent-flags.test.js covers: the seeded ["--print"] case, stripping out of a curated list while preserving order, a --afk pinned on kimi-tui, no-op when already clean, leaving other providers that legitimately use --print (claude-code, antigravity) alone, missing provider, non-array args, missing data/providers.json, and invalid JSON.
• server/lib/cliProviderArgs.test.js and server/lib/tuiHandshake.test.js updated for the corrected argv, including an explicit "never injects --print or --afk" assertion at the buildCliArgs level.

Closes #4139