feat(api): tool_use, split cache breakpoints, 1h TTL, pricing fixes

[That1Drifter]

Summary

Tightens API usage and prompt caching in the inner-Claude turn loop and the debrief generator.

• tool_use for structured output — inner-claude.ts now defines an emit_turn_response tool whose input_schema mirrors InnerClaudeTurnResponse, and forces it via tool_choice. The JSON-in-text parse path and the malformed-retry branch are gone; only the truncation retry remains. isInnerClaudeResponse stays as the runtime guard against tool_input drift.
• Split cache breakpoints — system prompt is now two ephemeral blocks. Block 1 is the static CONTRACT (5m TTL, reused globally across every scenario and session). Block 2 is the per-session scenario context + ticket sample (1h TTL via the extended-cache-ttl-2025-04-11 beta header). Previously the contract was lumped into the scenario block, so each new session re-paid cache-write on the contract too.
• Pricing table — re-keyed to exact dated prefixes (claude-sonnet-4-5, claude-sonnet-4-6, claude-opus-4-5, claude-opus-4-6, claude-haiku-4-5) so sonnet-4-5 and a future sonnet-4-6 don't collide on a claude-sonnet-4 prefix. startsWith lookup still resolves dated suffixes like claude-haiku-4-5-20251001.
• Model defaults bumped — MODEL_STAKEHOLDER and DEBRIEF_MODEL defaults are now claude-sonnet-4-6. Env overrides preserved.
• Client hoist — new Anthropic({ apiKey }) moved to a lazy module-level singleton in both inner-claude.ts and debrief.ts. The "ANTHROPIC_API_KEY not configured" error still throws at call time so import-time behavior is unchanged.
• Debrief caching — debrief system prompt extracted to SYSTEM_PROMPT and marked cache_control: ephemeral.
• TODO — added followups for the broken pnpm lint (next lint deprecation) and the now-misnamed TurnCallResult.rawText.

Test plan

• pnpm typecheck — clean across 6 packages
• pnpm test — 17 core + 7 scenarios + 10 rubric tests passing
• Smoke a real session end-to-end on staging to confirm tool_use + 1h TTL header are accepted by the API and cache hits show in usage.cache_read_input_tokens on turn 2+
• Confirm the debrief still renders narrative output with the new claude-sonnet-4-6 default

🤖 Generated with Claude Code

[That1Drifter]

Staging smoke results ✅

Deployed fcf7860 to staging and exercised the full turn loop + debrief on support-triage.

Test plan results

• ✅ tool_use accepted by API across haiku-4-5 and sonnet-4-6 — every call returned valid structured output, retried: false on every turn
• ✅ 1h cache header accepted — turn 1 wrote 6357-token prefix (cache_write: 6357, cache_read: 0)
• ✅ Cache hits on turn 2+ — every subsequent turn shows cache_write: 0, cache_read: 6357-6358
• ✅ Surprise tier auto-routes to claude-sonnet-4-6 — spam_reroute surprise fired and modelUsed: claude-sonnet-4-6, modelTier: stakeholder
• ✅ Debrief renders narrative on claude-sonnet-4-6 — multi-paragraph critique with per-turn references

Bug caught and fixed mid-test (fcf7860)
The first deploy hit 400 system.1.cache_control.ttl: a ttl='1h' cache_control block must not come after a ttl='5m' cache_control block. The Anthropic API requires longer-TTL cache blocks to be ordered before shorter ones. Bumped CONTRACT to 1h too — strictly better since it's static globally.

Sample turn 4 usage (sonnet-4-6, surprise tier)

usage: { input: 820, output: 565, cache_write: 0, cache_read: 6358 }
turnCostUsd: 0.0128

Pre-existing bug spotted in server log (not from this PR — flagging as separate issue)

SyntaxError: Invalid regular expression: /(?i)(deploy|ship|launch|rollout|production)/: Invalid group
  at .next/server/app/api/debrief/route.js:39:10591
  called from app/api/turn/route.js

Looks like a payload_regex rubric rule is using Python's (?i) inline flag, which JS regex doesn't support. Worth a follow-up fix in @fieldwork/rubric to either flip to the i flag or strip (?i) prefixes when compiling rules.

[That1Drifter]

Correction: the regex bug I flagged in the previous comment was already fixed in d791a3d. The two log entries I saw were from restarts before this branch's deploy — the current build (fcf7860, restart 21:57:31) has had zero errors. Disregard that followup.