SHS serve co-process (NDJSON) + env-var contract

[skhuang]

Summary

• Replace the popen-per-stuck-branch kofta-shs query path with one long-lived kofta-shs serve co-process, streamed over a pipe: one NDJSON request line (verified branch facts) → one JSON-array response line (candidate strings). A persistent process is what lets the Python side accumulate cost across the whole campaign and flush it on exit via --cost-out — the prerequisite for per-campaign cost accounting.
• Adopt the KOFTA_SHS=1 boolean + KOFTA_SHS_{BIN,MODEL,CACHE,COST,BUDGET,NOSLICE} env-var contract, replacing the merged command-string design. This matches shs/campaign.example.json, which already used these vars.
• Broken pipe / read failure disables the seam gracefully (no retry storm); SIGPIPE is ignored and detected via write()/getline() return values instead. Shutdown via atexit closes the co-process stdin so serve sees EOF and dumps --cost-out even under a timeout-driven SIGTERM (AFL's stop path exits cleanly through exit(0)).
• Fix kofta-shs shebang #!python3 → #!/usr/bin/env python3 so KOFTA_SHS_BIN is execvp-resolvable.
• Point docker/run-smoke.sh at the new contract (KOFTA_SHS=1 KOFTA_SHS_BIN=… KOFTA_SHS_CACHE=… KOFTA_SHS_COST=…) and print the resulting shs_cost.json; fix ./afl-fuzz → ./kofta-fuzz in shs/campaign.example.json and add KOFTA_SHS_BIN.

Test plan

• afl-fuzz.c compiles cleanly in both default and -DKOFTA_DEBUG builds (only the pre-existing macOS-only memfd_create incompatibility remains; Linux CI builds it).
• kofta-shs serve --mock verified end-to-end via the new shebang: NDJSON request → ["kofta_magic"] response → shs_cost.json dumped on EOF.
• NOSLICE ablation: a request with no source_slice yields [] from the mock client (nothing to echo).
• CI compile-check (default + KOFTA_DEBUG) on Ubuntu.
• Runtime smoke test on a native x86_64 Linux host (docker/smoke.sh) — blocked locally by KOFTA's x86_64-only argv-leak asm under arm64 emulation, orthogonal to this change.

🤖 Generated with Claude Code