feat(analyst): typed kinds for failure + recursive self-improvement (on top of #56)

[drewstone]

Stacks on #56 (feat/analyst-registry-and-findings).

What this adds

Replaces the legacy createTraceAnalystAdapter (string-bullet findings, flat severity/confidence defaults) with a typed-kind architecture anchored on Ax structured-output + Zod validation, plus four default kinds focused on agent failure and recursive self-improvement — not cost.

Substrate

• finding-signature.ts — strict Zod schema for one analyst-emitted row (severity / claim / subject / evidence_uri / confidence / rationale / recommended_action). RAW_FINDING_SCHEMA_PROMPT embeds the contract into every kind's actor prompt; rows that fail Zod are logged and dropped, not silently lifted with flat defaults.
• kind-factory.ts — createTraceAnalystKind(spec, { ai }) wires Ax agent(...) with findings:json[] output, the JS-runtime sandbox, advanced-mode recursion when maxDepth>0, and the per-kind tool subset. versionSuffix reserves the hook for optimizer-fitted prompts.
• tool-groups.ts — five named subsets (all / discovery / discoveryAndRead / discoveryAndSearch / targeted) so kinds take only the tools they need. Unknown group names throw.

Default kinds (in dependency order)

Kind	maxDepth	Brief
failure-mode	3	Clusters dataset failures into distinct modes with cited evidence. RLM fans out one subagent per cluster; confounded clusters split again next level.
knowledge-gap	2	Names missing/stale knowledge attributed to the runtime layer that should have held it. Anchored on @tangle-network/agent-knowledge (wiki:<page>, claim:<topic>, raw:<source>, stale:<page>), with secondary loci websearch:outdated:*, tool-doc:*, system-prompt:*, memory:*. Subagents fan out per layer.
knowledge-poisoning	2	Confident-but-wrong actions. DUAL-VERIFY protocol: subagents prove both (i) the agent acted on the belief AND (ii) the belief is false in this trace's evidence. Single-evidence findings get dropped.
improvement	3	Converts upstream findings into concrete locus-named edits. DISCOVERY → CANDIDATE-FIXES → COMPETE → CITE: competing fix candidates simulated by subagents; winning candidate per cluster emitted with leverage grade, rationale, and literal edit phrased as a diff. Cross-references upstream findings via evidence_uri: \"finding://<id>\".

Tests

21 new in kinds/kinds.test.ts covering:

• Zod schema: rejects out-of-range confidence, unknown severity, extra fields; logs rejection reason
• parseRawFinding: null + log on failure, typed value on success
• Default suite shape, run order, recursion budgets, finding_id stability
• Per-kind prompt invariants (clustering for failure-mode, dual-verify for poisoning, agent-knowledge anchoring for gaps)
• Tool-group filtering and unknown-name throw

Full suite: 1146/1146 pass, typecheck clean, pnpm build clean.

Why kinds, not one big trace-analyst

• Typed outputs — severity / confidence / evidence become first-class instead of flat-defaulted at the adapter layer.
• Narrow tools per kind — failure-mode gets full discovery; knowledge-gap only needs search; targeted analysts skip full-trace dumps.
• Real RLM depth — recursion budgets per kind (2 or 3) so the LLM actually fans out instead of doing all work at the root.
• Composable via finding://<id> — improvement kind chains on top of upstream findings. The registry already supports the finding evidence kind; this PR makes it useful.

Deferred

• Ax optimizer hook (MIPRO / GEPA / Bootstrap) — Ax 19.0.45 .d.ts is missing optimizer-class exports that 21.x ships. Goldens are kept as data on TraceAnalystKindSpec so the hook lands in a small follow-up after Ax bump.
• Streaming forward — streamingForward exists in Ax; kinds use forward for now. Switching is mechanical once any kind benefits from progressive emission.

Test plan

• pnpm typecheck — clean
• pnpm vitest run src/analyst — 41/41 pass
• pnpm test — 1146/1146 pass
• pnpm build — clean
• Wire one kind end-to-end against a real trace dataset in PR-B (blueprint-agent)