[backryun]

Summary

• Add a machine-ID-based Kiro IDE client profile for runtime and control-plane request identities.
• Apply the native runtime User-Agent, agent-mode, and opt-out headers in the Kiro executor.
• Remove the non-native prompt-caching headers from Kiro runtime requests.
• Add focused header coverage for runtime identity, control-plane identity, and native machine ID use.

Scope

This is the focused header/identity slice Diego requested after closing #8229. That PR mixed the useful native-IDE identity work with catalog and discovery rewrites that threatened the VPS-verified Kiro catalog from #6170.

• This PR does not change the Kiro model registry, the fix(providers): correct Kiro model catalog to real upstream ids #6170 catalog, or its catalog guard tests.
• No fabricated model IDs are restored, including claude-opus-4.8, claude-opus-4.7, claude-opus-4.6, claude-sonnet-4.6, or auto-kiro.
• Discovery and control-plane endpoint changes are deferred to a follow-up that requires live VPS validation.
• The existing Kiro runtime endpoint selection remains unchanged; this PR only aligns request identity and headers.

Validation

• npm run typecheck:core
• node --import tsx/esm --test tests/unit/executor-kiro.test.ts tests/unit/kiro-catalog-real-models.test.ts — 17 passed
• npx eslint open-sse/services/kiroClientProfile.ts open-sse/executors/kiro.ts open-sse/config/providerHeaderProfiles.ts tests/unit/executor-kiro.test.ts
• git diff --check origin/release/v3.8.49...HEAD
• Empty diff: open-sse/config/providers/registry/kiro/
• Empty diff: tests/unit/kiro-catalog-real-models.test.ts