feat(channel,runtime): 批次2 后端 — 消息级角色归属进上下文 + IM 私聊随主会话角色 + 渠道级绑定

按 design/22 §2/§3/§4.4/§7（3/4/5）。
- ①「消息级角色归属」进入模型上下文（批次 1 只做存储+DTO）：历史消息的发送角色现在对模型可见，且**不把系统元数据塞进用户正文**（design/11 §10 红线）
- ② IM owner 私聊镜像解析出的角色 = **主会话绑定的角色**（§7-3）
- ③ 渠道级绑定：ChannelAccount 加 personaId（channels.json 读写/校验/脱敏沿用既有约定）+ 角色解析优先级 **会话 > 渠道 > 默认** + **群聊/陌生人强制默认角色**（§7-4）；admin 渠道配置端点支持 personaId
- Docs/api-client 版本 +1
- 验收：go build/vet/test 全绿 + linux/darwin 交叉编译

cmd/cyrene/channels.go

@@ -68,6 +68,25 @@ func (f *channelFactory) Build(platform string) ([]adapter.PlatformAdapter, erro
 	return buildPlatformAdapters(platform, accounts[platform], f.log), nil
 }
 
+// Persona returns the role bound to one channel account of a platform (design/22
+// §2 方案 b). It reads the same effective config Build does — channels.json wins,
+// env is the fallback — so the panel's save plus the bridge's hot reload stay the
+// single update path, and it is called once per adapter connect rather than per
+// message. An unknown platform/account, or an account without a personaId, returns
+// "" (no channel-level binding: the session binding or the global default applies).
+func (f *channelFactory) Persona(platform, accountID string) string {
+	accounts, warn := runtimeconfig.LoadChannels(f.path, f.fallback)
+	if warn != nil {
+		f.log.Warn("channels.json persona lookup fell back to env", "error", warn)
+	}
+	for _, acct := range accounts[platform] {
+		if strings.TrimSpace(acct.ID) == strings.TrimSpace(accountID) {
+			return strings.TrimSpace(acct.PersonaID)
+		}
+	}
+	return ""
+}
+
 // buildPlatformAdapters builds every account of one platform into an adapter
 // instance. A failed account build is skipped with a warn (never fatal), matching
 // the "no credentials → warn and continue" contract of the bridge.

cmd/cyrene/persona_prompt.go

@@ -149,6 +149,24 @@ func (a *app) personaKnobs(personaID string) (loop.LoopKnobs, bool) {
 	}, true
 }
 
+// personaName resolves a role id to its display name for the model context's
+// speaker attribution (loop.Options.PersonaName, design/22 §7-5). The loop names a
+// speaking role as "「昔涟」（xilian）" instead of a bare id, so the model can follow
+// who said what after a session switched roles. An empty or unknown id resolves to
+// "" and the loop falls back to the id alone — attribution never disappears just
+// because a name could not be resolved, and nothing here is an identity or
+// permission input.
+func (a *app) personaName(personaID string) string {
+	if personaID == "" {
+		return ""
+	}
+	p, ok := a.personas.Persona(personaID)
+	if !ok || p == nil {
+		return ""
+	}
+	return strings.TrimSpace(p.Name)
+}
+
 // personaThinking maps the persona's `thinking` section onto the model-layer
 // knobs (design/01 §2.1 / design/04 §3.2). It returns (nil, "") when nothing
 // affects the request.

cmd/cyrene/wire.go

@@ -435,6 +435,7 @@ func (a *app) wireRuntime() error {
 		Flow:               flowPub,
 		Guards:             guards,
 		PersonaID:          personaID,
+		PersonaName:        a.personaName,
 		PersonaKnobs:       a.personaKnobs,
 		Timezone:           a.cfg.Timezone,
 		MaxRounds:          defaultMaxRounds,
@@ -661,6 +662,10 @@ func (a *app) wireChannels() error {
 		// Factory lets the panel save hot-replace a platform's adapters without a
 		// restart (design/04 §3.1).
 		Factory: factory,
+		// ChannelPersona resolves an account's channel-level role from the same
+		// config the factory builds from (design/22 §2 方案 b); the bridge caches it
+		// per connected adapter and refreshes it on every reload.
+		ChannelPersona: factory.Persona,
 	})
 	if berr != nil {
 		return fmt.Errorf("channel bridge: %w", berr)