feat(model,capacity,vision,io): per-persona 路由 + 本地三级(默认关) + L3 分类 + OCR 独立模型 + image-crop 工具（裁决 03.4.1/03.4.3/14.4.1/14.4.4/14.4.5）

- 03.4.1：per-persona 路由载体选 models.json（组内新增 personaModels/personaProviders + 校验 + PersonaRoute()），
  Router/RuntimeLLM 快照绑定、loop 流式路径按该 turn 的 persona 路由；主步用路由结果、降级步钉自己的模型
- 03.4.3：本地第三级降级链（LLM_LOCAL_*，Configured() 含 Enabled ⇒ **默认关**），warn 标注来源
- 14.4.4：capacity 接入 L3（分类器接口 + TTL 缓存 + 严格 JSON 解析），CAPACITY_L3_ENABLED **默认 false**
- 14.4.1：语义修正 —— group.multimodal 才是「主模型能否收图」（env 路径不再臆断），LLM_VISION_MODEL 只配视觉工具；
  vision/OCR 可各用不同模型；runtime 不再因有图抢路由（vision.Router 是唯一分层权威）
- 14.4.5：新增 image-crop 工具（工具数 5→6，策略默认 owner-only），schema 支持按区域裁切
- 组合根：wire_runtime 读 group.Multimodal；capacity 装配拆出 wire_capacity.go（守 500 行）
- 复核：`go build`/`go vet`/各包 `go test -count=1` 全绿；**6 条变异反证**先红后还原（含作者自查出的 2 条假阳性变异）
- 未落：按 provider 的 thinking 开关（需 openai_encode.go/openai.go 文件面）、persona awakening（需 loader 文件面）

internal/runtime/capacity/l3.go

@@ -0,0 +1,134 @@
+package capacity
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"time"
+)
+
+// IntentClassifier is the model-assisted intent classifier behind the L3 layer
+// (design/14 §2.2 L3; 裁决 14.4.4). It is an interface so the decision engine
+// stays testable without a model: the wiring supplies the LLM-backed
+// implementation (NewLLMClassifier), a test supplies a stub.
+//
+// Classify returns the raw judgment for one turn's text — {isTask, taskKind,
+// confidence} plus nothing else. An error means "no verdict": the caller keeps
+// the conservative default rather than guessing.
+type IntentClassifier interface {
+	Classify(ctx context.Context, text string) (Judgment, error)
+}
+
+// maxL3CacheEntries bounds the L3 verdict cache so a long-lived process cannot
+// grow it without limit. Past the bound, expired entries are dropped first and
+// the cache is cleared if every entry is still fresh.
+const maxL3CacheEntries = 256
+
+// ErrEmptyTurn is returned when the L3 classifier is asked to judge empty turn
+// text. It is a sentinel so callers (and tests) can test the category without
+// matching on the message text.
+var ErrEmptyTurn = errors.New("capacity: empty turn text for L3 classification")
+
+// DefaultL3CacheTTL is the default reuse window for an L3 verdict — the landing
+// suggestion of 裁决 14.4.4 (5m): long enough that a repeated phrase inside one
+// conversation costs one model call, short enough that a changed habit re-learns.
+const DefaultL3CacheTTL = 5 * time.Minute
+
+// l3Cache memoizes classifier verdicts per turn text for a bounded TTL, so the
+// same phrase does not cost a model call on every round. A zero TTL disables
+// reuse. The classifier call happens outside the lock: two concurrent turns must
+// not serialize on each other's model call.
+type l3Cache struct {
+	classifier IntentClassifier
+	ttl        time.Duration
+
+	mu      sync.Mutex
+	entries map[string]l3Entry
+}
+
+// l3Entry is one cached verdict with the time it was produced.
+type l3Entry struct {
+	judgment Judgment
+	at       time.Time
+}
+
+// newL3Cache builds the cache. A nil classifier yields nil, which the decider
+// treats as "L3 not available".
+func newL3Cache(classifier IntentClassifier, ttl time.Duration) *l3Cache {
+	if classifier == nil {
+		return nil
+	}
+	return &l3Cache{classifier: classifier, ttl: ttl, entries: map[string]l3Entry{}}
+}
+
+// classify returns the verdict for text, reusing a fresh cached one when
+// possible. The bool reports whether a verdict was produced; an error is returned
+// to the caller for reporting instead of being swallowed here.
+func (c *l3Cache) classify(ctx context.Context, text string) (Judgment, error) {
+	key := l3CacheKey(text)
+	if key == "" {
+		return Judgment{}, ErrEmptyTurn
+	}
+	if j, ok := c.lookup(key, time.Now()); ok {
+		return j, nil
+	}
+	j, err := c.classifier.Classify(ctx, text)
+	if err != nil {
+		return Judgment{}, err
+	}
+	c.store(key, j, time.Now())
+	return j, nil
+}
+
+// lookup returns a fresh cached verdict, if any.
+func (c *l3Cache) lookup(key string, now time.Time) (Judgment, bool) {
+	if c.ttl <= 0 {
+		return Judgment{}, false
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e, ok := c.entries[key]
+	if !ok {
+		return Judgment{}, false
+	}
+	if now.Sub(e.at) > c.ttl {
+		return Judgment{}, false
+	}
+	return e.judgment, true
+}
+
+// store records a verdict, evicting expired entries (and, if the bound is still
+// exceeded, the whole map) so the cache cannot grow without limit.
+func (c *l3Cache) store(key string, j Judgment, now time.Time) {
+	if c.ttl <= 0 {
+		return
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if len(c.entries) >= maxL3CacheEntries {
+		c.evictExpired(now)
+	}
+	c.entries[key] = l3Entry{judgment: j, at: now}
+}
+
+// evictExpired drops entries past their TTL; when none expired, it clears the
+// map so a burst of distinct turns cannot pin the memory.
+func (c *l3Cache) evictExpired(now time.Time) {
+	dropped := 0
+	for k, e := range c.entries {
+		if now.Sub(e.at) > c.ttl {
+			delete(c.entries, k)
+			dropped++
+		}
+	}
+	if dropped == 0 {
+		c.entries = map[string]l3Entry{}
+	}
+}
+
+// l3CacheKey normalizes a turn's text into the cache key. Empty text (nothing to
+// classify) yields "".
+func l3CacheKey(text string) string {
+	return strings.TrimSpace(text)
+}