feat(model,capacity,vision,io): per-persona 路由 + 本地三级(默认关) + L3 分类 + OCR 独立模型 + image-crop 工具（裁决 03.4.1/03.4.3/14.4.1/14.4.4/14.4.5）

- 03.4.1：per-persona 路由载体选 models.json（组内新增 personaModels/personaProviders + 校验 + PersonaRoute()），
  Router/RuntimeLLM 快照绑定、loop 流式路径按该 turn 的 persona 路由；主步用路由结果、降级步钉自己的模型
- 03.4.3：本地第三级降级链（LLM_LOCAL_*，Configured() 含 Enabled ⇒ **默认关**），warn 标注来源
- 14.4.4：capacity 接入 L3（分类器接口 + TTL 缓存 + 严格 JSON 解析），CAPACITY_L3_ENABLED **默认 false**
- 14.4.1：语义修正 —— group.multimodal 才是「主模型能否收图」（env 路径不再臆断），LLM_VISION_MODEL 只配视觉工具；
  vision/OCR 可各用不同模型；runtime 不再因有图抢路由（vision.Router 是唯一分层权威）
- 14.4.5：新增 image-crop 工具（工具数 5→6，策略默认 owner-only），schema 支持按区域裁切
- 组合根：wire_runtime 读 group.Multimodal；capacity 装配拆出 wire_capacity.go（守 500 行）
- 复核：`go build`/`go vet`/各包 `go test -count=1` 全绿；**6 条变异反证**先红后还原（含作者自查出的 2 条假阳性变异）
- 未落：按 provider 的 thinking 开关（需 openai_encode.go/openai.go 文件面）、persona awakening（需 loader 文件面）

plugins/tools/io/doc.go

@@ -1,7 +1,7 @@
 // Package io implements the built-in I/O and network tools for Cyrene v2
-// (DevDocs/design/09-插件生态.md). It exposes file, http, web-search, web-fetch
-// and knowledge as pkg/plugins/sdk.Tool values, wired to the process-internal
-// config, logger and runtime/memory retriever.
+// (DevDocs/design/09-插件生态.md). It exposes file, image-crop, http, web-search,
+// web-fetch and knowledge as pkg/plugins/sdk.Tool values, wired to the
+// process-internal config, logger and runtime/memory retriever.
 //
 // Build the full configured tool set with New(cfg, opts...). Tools() and
 // Register(reg) are convenience wrappers that use platform defaults; production
@@ -13,6 +13,10 @@
 //   - file: every path is cleaned and validated to stay inside the configured
 //     data directory or an explicit whitelist; ".." traversal and symlink escape
 //     are rejected; reads and writes are size-capped.
+//   - image-crop: crops a region out of a large image so the agent can read it in
+//     parts (an image service downsamples big images); path sources go through the
+//     file sandbox, URL sources through the SSRF guard, and the returned data URI
+//     is size-capped.
 //   - http: GET/POST only, timeouts, response truncation and SSRF protection
 //     (loopback/private/link-local addresses and localhost are refused unless
 //     the host is on an explicit allowlist).