ci(nightly): harden kiro etag, cursor resolver, no-cache comment

[chaodu-agent]

Follow-up to #1519 addressing review findings from the two-reviewer pass (Sol, Fable) that landed after merge.

Findings addressed

#	Reviewer	Severity	Fix
F1	Sol	latent hard-break	Kiro latest-object ETag validation now accepts multipart ETags (<md5>-<partcount>), not only single-part 32-hex. The ~586MB object sits at the S3 multipart boundary; a future re-upload flipping its ETag to the suffixed form would otherwise hard-fail every nightly-kiro build with no SHA fallback. If-Match accepts multipart ETags, so both shapes are valid preconditions.
#2	Fable	flakiness	Cursor resolver uses grep -m1 instead of grep … | head -1, avoiding the SIGPIPE (exit 141) that head-closing-the-pipe triggers under pipefail and which surfaced as a spurious red job.
F5	Sol	comment accuracy	Corrected the misleading no-cache: true comment — no-cache rebuilds every Dockerfile.package layer for the variant (base image, apt/node, CLI install), not just the CLI layer. The openab binary is not recompiled (prebuilt via the bins= build context).

Optional nits from the review (check_ver leading-dash guard, npm --retry-all-errors, immutable-tag pre-existence check, docs for the two tag families) are intentionally not in this PR to keep it minimal; they can follow separately.

Tested

• python3 -c "import yaml; yaml.safe_load(...)" → YAML parses.
• Verified grep -oE -m1 … | sed … extracts the first cursor version and exits 0 under set -o pipefail (no exit 141), locally reproducing the SIGPIPE-avoidance.
• F1/F5 are a regex-widening and a comment change respectively; no behavior change on the release/pre-beta path (those pass their pinned SHAs and never hit the ETag branch).

Blocked / not verified

• Did not run the full nightly workflow end-to-end (requires the scheduled/dispatch trigger on main and GHCR push); changes are confined to the resolve/build steps and validated by YAML parse + local shell repro.

---

Review Contract

Acceptance criteria

1. Kiro ETag validation accepts both ^[0-9a-f]{32}$ and ^[0-9a-f]{32}-[0-9]+$.
2. Cursor resolver no longer uses head in a pipe; first-match extraction preserved.
3. no-cache comment accurately describes what is rebuilt.
4. No change to the release (v*) or pre-beta build paths; parity check unaffected.

Out of scope (non-blocking follow-ups): check_ver leading-dash guard, npm retry-all-errors, immutable-tag pre-existence check, tag-family docs.

Stopping rule: default three-stage (full review → fix verification → final regression check).