feat(model): 按 provider 形状独立适配推理开关 + per-persona 提供商链真接线（裁决 03.4.2/08.4.1/03.4.1 余项）

- 新增 reasoning_shape.go：**每个 provider 形状一个 resolver，只发自己形状的字段**
  · deepseek：thinking{type} + reasoning_effort（依据 DevDocs/reference/deepseek 官方本地副本）
  · vllm：chat_template_kwargs.enable_thinking　· dashscope：顶层 enable_thinking（**只允许显式声明**）
  · openai：仅 reasoning_effort　· anthropic：自己的 thinking{budget_tokens}（未改）
  · 未知 kind → WARN 且一个字段都不发（不许静默失效）
- 形状载体：models.json 组级 `reasoning.kind`（可热更新，未声明则不写该键）+ env `LLM_REASONING_KIND`
- 红线：`effort:none` 在只有布尔开关的形状上翻成**显式关思考**，绝不降成任何强度档
- 03.4.1 余项：`Request.PersonaID` + `RuntimeLLM.ForPersona(pid)` 视图；
  每 persona 协议一条链并消费 `RouteProviderForPersona`；`agent/request.go` 非流式路径同一钩子
- **生产装配（主会话补）**：默认 agent 与 personaAgentPool 都改用 `ForPersona(pid)` 视图——
  否则角色级模型/提供商路由在生产里永不被选中（形同虚设）
- 复核：build/vet 绿 + model/agent/config/cmd 包测试绿；5 条变异反证先红后还原
  （其中一条「红但没钉住」已改用例：通道读取加 2s 超时，避免整包 panic 掩盖信号）
- 未落：DashScope 的 auto 推断（缺官方依据，只允许显式声明）；Qwen `/think` 前导消息
  （design/01 §2.1 与 design/11 §3 口径冲突，停手报告）

internal/runtime/model/runtime.go

@@ -29,6 +29,11 @@ type runtimeChainSnapshot struct {
 	router *Router
 	group  runtimeconfig.Group
 	groups []runtimeconfig.Group
+	// providerChains holds one chain per *other* protocol declared by the active
+	// group's personaProviders (裁决 03.4.1 的 per-persona provider：跨协议换
+	// adapter). A persona whose provider binding resolves to one of these keys is
+	// served by that chain; every other request keeps the default chain above.
+	providerChains map[string]*Chain
 }
 
 // RuntimeLLM is the hot-swappable LLM provider stack for the runtime. It
@@ -96,11 +101,12 @@ func (m *RuntimeLLM) Model() string { return m.load().group.Model }
 // Name implements Adapter, returning the active group id.
 func (m *RuntimeLLM) Name() string { return m.load().group.ID }
 
-// Chat implements Adapter, delegating to the current chain. A request that began
-// before a reload completes on the snapshot it captured. When no model is
-// configured (nil chain) it returns ErrNoModel rather than panicking.
+// Chat implements Adapter, delegating to the chain the request's persona
+// resolves to. A request that began before a reload completes on the snapshot it
+// captured. When no model is configured (nil chain) it returns ErrNoModel rather
+// than panicking.
 func (m *RuntimeLLM) Chat(ctx context.Context, req Request, opts Options) (Response, error) {
-	chain := m.load().chain
+	chain := m.chainFor(req.PersonaID)
 	if chain == nil {
 		return Response{}, ErrNoModel
 	}
@@ -109,13 +115,39 @@ func (m *RuntimeLLM) Chat(ctx context.Context, req Request, opts Options) (Respo
 
 // ChatStream implements Adapter.
 func (m *RuntimeLLM) ChatStream(ctx context.Context, req Request, onEvent func(StreamEvent)) (Response, error) {
-	chain := m.load().chain
+	chain := m.chainFor(req.PersonaID)
 	if chain == nil {
 		return Response{}, ErrNoModel
 	}
 	return chain.ChatStream(ctx, req, onEvent)
 }
 
+// chainFor resolves the chain that serves this persona (裁决 03.4.1 的
+// per-persona provider). It consumes Router.RouteProviderForPersona — the
+// provider decision the router already made for this persona — and only switches
+// when BOTH hold:
+//
+//   - the persona has its own model binding (an entry in personaProviders alone
+//     would send the group's default model name to another vendor's endpoint),
+//   - and a chain exists for that provider (a declared protocol with no matching
+//     group in models.json is reported when the snapshot is built, and the
+//     persona then keeps the default chain rather than failing the turn).
+//
+// Everything else — no persona, no binding, same protocol as the active group —
+// returns the default chain, so a deployment without per-persona providers
+// behaves exactly as before.
+func (m *RuntimeLLM) chainFor(persona string) *Chain {
+	snap := m.load()
+	if p := trimKey(persona); p != "" && snap.router != nil {
+		if _, _, ok := snap.group.PersonaRoute(p); ok {
+			if c := snap.providerChains[snap.router.RouteProviderForPersona(p)]; c != nil {
+				return c
+			}
+		}
+	}
+	return snap.chain
+}
+
 // RouteRequest implements ModelRouter, delegating to the current router.
 func (m *RuntimeLLM) RouteRequest(req Request) (string, bool) {
 	r := m.load().router
@@ -196,7 +228,99 @@ func buildSnapshot(groups []runtimeconfig.Group, env config.LLMConfig, log *slog
 		chain = chain.WithTokenBudget(active.MaxTokens, env.FallbackMaxTokens)
 	}
 	router := NewRouter(DefaultModelForProvider(cfg), personaRouterOptions(active, cfg)...)
-	return &runtimeChainSnapshot{chain: chain, router: router, group: active, groups: groups}, nil
+	return &runtimeChainSnapshot{
+		chain:          chain,
+		router:         router,
+		group:          active,
+		groups:         groups,
+		providerChains: personaProviderChains(groups, active, env, log),
+	}, nil
+}
+
+// personaProviderChains builds one chain per protocol that the active group's
+// personaProviders declares and that models.json actually provides a group for
+// (裁决 03.4.1 的 per-persona provider：跨协议换 adapter). The persona's own
+// model name is pinned as the chain's primary model, so a caller that stamps the
+// persona without a routed model name still reaches the right endpoint.
+//
+// A persona that names the same protocol as the active group needs no chain of
+// its own: the default chain already speaks that protocol, and the per-persona
+// model name reaches it through the router. A personaProviders entry whose
+// protocol has no group is reported and skipped — a half-built chain could only
+// fail, and the persona keeps the default chain instead.
+func personaProviderChains(groups []runtimeconfig.Group, active runtimeconfig.Group, env config.LLMConfig, log *slog.Logger) map[string]*Chain {
+	if len(active.PersonaProviders) == 0 {
+		return nil
+	}
+	out := make(map[string]*Chain, len(active.PersonaProviders))
+	for persona := range active.PersonaProviders {
+		model, provider, ok := active.PersonaRoute(persona)
+		if !ok {
+			warn(log, "personaProviders entry ignored: the persona binds no model of its own",
+				"persona", persona, "field", "personaModels")
+			continue
+		}
+		if provider == active.Provider {
+			continue
+		}
+		if _, built := out[provider]; built {
+			continue
+		}
+		g, found := groupForProvider(groups, provider)
+		if !found {
+			warn(log, "per-persona provider skipped: no models.json group speaks it",
+				"persona", persona, "provider", provider)
+			continue
+		}
+		chain := personaChain(g, model, env, log)
+		if chain != nil {
+			out[provider] = chain
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+// personaChain builds and budgets the chain serving one persona through another
+// vendor's group: the group's flat config with the persona's own model name as
+// the primary model, plus the shared local last rung. The reasoning shape
+// (reasoning.kind) travels with the group's config, so a persona routed to
+// another vendor keeps that vendor's switch shape. It reports the reason and
+// returns nil when the group cannot serve a chain.
+func personaChain(g runtimeconfig.Group, model string, env config.LLMConfig, log *slog.Logger) *Chain {
+	cfg := g.ToLLMConfig()
+	if cfg.Provider == ProviderAnthropic {
+		cfg.AnthropicModel = model
+	} else {
+		cfg.Model = model
+	}
+	cfg.Local = env.Local
+	chain, err := NewChatChainWithLog(cfg, log)
+	if err != nil && !errors.Is(err, ErrNoModel) {
+		warn(log, "per-persona chain skipped", "group", g.ID, "model", model, "error", err)
+		return nil
+	}
+	if chain == nil {
+		warn(log, "per-persona chain skipped: the provider group has no base url or model",
+			"group", g.ID, "model", model)
+		return nil
+	}
+	return chain.WithTokenBudget(g.MaxTokens, env.FallbackMaxTokens)
+}
+
+// groupForProvider returns the first group speaking the given protocol. The group
+// order in models.json is the operator's choice, so "first match" is a stable,
+// documentable rule rather than a silent pick — a duplicate protocol is reported
+// by the builder when it matters.
+func groupForProvider(groups []runtimeconfig.Group, provider string) (runtimeconfig.Group, bool) {
+	for _, g := range groups {
+		if g.Provider == provider {
+			return g, true
+		}
+	}
+	return runtimeconfig.Group{}, false
 }
 
 // personaRouterOptions turns the active group's per-persona model/provider