fix(compressor): pin summary role to user when only system prompt is protected (#52160)

[liuhao1024]

What does this PR do?

Fixes HTTP 400 errors from Anthropic (and Bedrock) after the second context compression. The compressor's summary message was assigned role=assistant when only the system prompt was protected, making it the first visible message in the API request — which Anthropic unconditionally rejects.

Related Issue

Fixes #52160

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• agent/context_compressor.py: When last_head_role == "system" (only the system prompt is protected — typical on second+ compression), force summary_role = "user" and guard the tail-collision flip logic so it cannot revert to "assistant". If the first tail message is also "user", the summary merges into the tail instead.
• tests/agent/test_context_compressor.py: Two regression tests:
  • test_double_compaction_summary_must_be_user_when_only_system_protected: Verifies the summary is role=user after the second compression.
  • test_double_compaction_user_tail_merges_into_tail: Verifies that when the tail also starts with user, the summary merges into the tail rather than flipping back to assistant.

How to Test

1. python -m pytest tests/agent/test_context_compressor.py::TestCompressWithClient::test_double_compaction_summary_must_be_user_when_only_system_protected tests/agent/test_context_compressor.py::TestCompressWithClient::test_double_compaction_user_tail_merges_into_tail -v
2. Run the full compressor test suite: python -m pytest tests/agent/test_context_compressor.py -q (122 tests, all should pass)
3. To reproduce the original bug: start a long session on an Anthropic provider, trigger two context compressions, and observe that the API call no longer fails with HTTP 400.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/agent/test_context_compressor.py -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Code Intelligence

• Analyzed: agent/context_compressor.py ContextCompressor.compress() (lines 2596-2616, role-assignment block)
• Blast radius: LOW — only affects the summary-role decision when last_head_role == "system", which is a previously-unhandled edge case
• Related patterns: _effective_protect_first_n() decay after first compression, Anthropic system-message extraction