feat(backend): add Kilo CLI as backend provider

[PawiX25]

Summary

Adds a Kilo CLI backend selectable via "backend": "kilo" in
~/.talon/talon.json. Spawns kilo serve --hostname 127.0.0.1 --port 4097
via cross-spawn; talks to it over the @kilocode/sdk v2 client. Mirrors
the existing OpenCode backend in shape: lifecycle management, session
handling, model catalog with provider routing, MCP server registration.

What's included

src/backend/kilo/ — 6 files, ~2050 LOC

• index.ts — exports + initKiloAgent / stopKiloServer entry points.
• server.ts — server process spawn, MCP server registration,
  tool overrides, plugin MCP propagation.
• handler.ts — query handler: stream events, tool-use propagation,
  end-turn detection.
• sessions.ts — per-chat session state, message accumulation,
  tool-call mapping.
• model-provider.ts — resolveModel, getModelInfo,
  getSettingsPresentation, getProviders, listModels — plugs
  into the QueryBackend abstraction in core/types.ts.
• models.ts — model catalog (~758 LOC) with provider routing,
  bucket priority, normalized lookup, query parsing.

Wire-up

• src/bootstrap.ts — adds Kilo branch in initBackendAndDispatcher.
• src/util/config.ts — "kilo" added to backend enum.
• package.json — adds @kilocode/sdk@^7.2.22; lockfile regenerated.

Configuration example

{
  "backend": "kilo",
  "model": "anthropic/claude-sonnet-4-5"
}

Talon will spawn kilo serve on localhost:4097 and route queries
through it. Models are resolved against the Kilo catalog with the
same provider/model semantics as OpenCode.

Out of scope (future work)

• Kilo-specific tool-output renderers (currently shared with
  OpenCode rendering path).

[claudiusthebot]

Drive-by CI note (not a maintainer, just observing) — second PR from this contributor in ~18 minutes (after #160). This one is fully green on first push: 21/22 jobs green, 1 skipped (Auto-Merge, expected behavior).

All passing: Tests on ubuntu × {Node 22, 24} / macOS × Node 22 / windows × Node 22; Functional + Integration on all 3 OSes; Docker Build; Tarball; CodeQL; Dependency Review; Secret Scan; Lockfile Portability; Security Audit; Fuzz Testing; Code Quality.

The combined-status rollup may show "pending" — that's the legacy commit-status API not reflecting check-runs (same surface oddity as #160). The check-runs view is the source of truth.

No CI noise to clear — substantive review on whether Kilo is a path Talon wants is Dylan's call.

— Talon (heartbeat instance)

[dylanneve1]

Looks good to me! Thanks