docs(cyrene): cmd/cyrene 存量英文注释中文化（22 个非测试文件，仅注释）

- 四组并行完成：main/wire*.go、wire_capacity|channels|runtime、channels|persona_*|emotion|observability、
  voice|plugins|stream|skills|vision|subagent_tool|extractor|mcp|sessionread_tool|terminal_tool。
- 机械校验（git diff -U0 去 // 行与空行）仅剩 wire_frontend.go:84 一处行尾注释：代码前缀
  「\ta.gw = gw 」经 cat -A 与 HEAD 逐字节比对一致（allow 清单已声明）。
- 验收：隔离 worktree（HEAD + 本批 patch）go build/vet 绿、全树 58 包 ok、
  linux/amd64 + darwin/arm64 交叉编译绿；gofmt -l 干净。
- 备注：整树两次红均为负载敏感 flake（backthink / orchestration 的 timeout 类用例单独 -count=20 全过）。

cmd/cyrene/sessionread_tool.go

@@ -9,17 +9,14 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/sessionread"
 )
 
-// wireSessionReadTool registers the design/22 §8-3 cross-session read tool, so the
-// running role can pull another Web session's context as external, read-only
-// material (design/22 §8.1).
+// wireSessionReadTool 注册 design/22 §8-3 的跨会话读取工具，使运行中的角色能把
+// 另一个 Web 会话的上下文作为外部只读材料拉取过来（design/22 §8.1）。
 //
-// The capability is registered with its default reachability markers (both false),
-// which keeps it owner-only: the design/11 §3 policy engine hides the schema from a
-// group/stranger session and the loop's security gate rejects the call there. The
-// tool's own fail-closed check (owner environment + the web/web:<uuid> whitelist)
-// runs behind that gate, so an unauthorized read is refused twice over. The
-// audit trail is the loop's gate/OnAudit, exactly as for every other tool — no
-// bypass path is added here.
+// 该能力以默认的可达性标记（两者皆 false）注册，从而保持仅主人可用：design/11 §3 的
+// 策略引擎会对群聊/陌生人会话隐藏其 schema，循环的安全门也会在那里拒绝调用。工具
+// 自身的 fail-closed 检查（主人环境 + web/web:<uuid> 白名单）运行在那道门之后，
+// 因此未授权的读取会被双重拒绝。审计链路就是循环的 gate/OnAudit，与其他每个工具
+// 完全一致 —— 这里不添加任何绕过路径。
 func (a *app) wireSessionReadTool() {
 	log := logger.WithSource(a.log, "cmd/cyrene")
 	if a.history == nil {
@@ -43,11 +40,10 @@ func (a *app) wireSessionReadTool() {
 	log.Info("session read tool registered", "tool", sessionread.ToolName, "owner_only", true)
 }
 
-// sessionReadLocation resolves the configured IANA zone for the material's
-// timestamps, so the external transcript reads in the same clock as the loop's
-// per-round "current time" injection (internal/runtime/loop/time.go). An unset zone
-// or one that fails to load returns nil, which keeps the tool's process-local
-// default — the read must not fail over a display setting.
+// sessionReadLocation 解析材料时间戳所用的已配置 IANA 时区，使外部 transcript 与
+// 循环逐轮注入的「当前时间」读同一个时钟（internal/runtime/loop/time.go）。未设置
+// 时区或加载失败时返回 nil，保持工具的进程本地默认值 —— 读取不该因为一个展示设置
+// 而失败。
 func (a *app) sessionReadLocation(log *slog.Logger) *time.Location {
 	if a.cfg == nil || a.cfg.Timezone == "" {
 		return nil
@@ -61,17 +57,15 @@ func (a *app) sessionReadLocation(log *slog.Logger) *time.Location {
 	return loc
 }
 
-// sessionReadPersonas adapts the persona registry to sessionread.PersonaNamer. The
-// tool package deliberately does not import internal/persona/registry (it holds a
-// narrow interface instead, keeping the layering one-way), so the composition root
-// supplies the display-name lookup.
+// sessionReadPersonas 把人格注册表适配为 sessionread.PersonaNamer。该工具包刻意不
+// 导入 internal/persona/registry（而是持有一个窄接口，保持分层单向），因此由组合根
+// 提供显示名查询。
 type sessionReadPersonas struct {
 	reg *personareg.Registry
 }
 
-// PersonaName implements sessionread.PersonaNamer: the persona's display name, or
-// ok=false for an unknown/unregistered role so the tool shows the raw id rather
-// than inventing a name.
+// PersonaName 实现 sessionread.PersonaNamer：返回人格的显示名；对未知/未注册的角色
+// 返回 ok=false，使工具展示原始 id 而不是编造一个名字。
 func (p sessionReadPersonas) PersonaName(id string) (string, bool) {
 	if p.reg == nil || id == "" {
 		return "", false
@@ -83,9 +77,9 @@ func (p sessionReadPersonas) PersonaName(id string) (string, bool) {
 	return persona.Name, true
 }
 
-// DefaultPersonaID implements sessionread.PersonaNamer: the persona bound to the
-// library's default character, mirroring (*app).defaultPersonaID. An empty id means
-// the material renders the explicit "no role set" marker instead of guessing.
+// DefaultPersonaID 实现 sessionread.PersonaNamer：返回库默认角色所绑定的人格，与
+// (*app).defaultPersonaID 保持一致。空 id 表示材料渲染显式的「未设置角色」标记，
+// 而不是靠猜。
 func (p sessionReadPersonas) DefaultPersonaID() string {
 	if p.reg == nil {
 		return ""