…, deliver outbox media

The WeCom AI Bot adapter was leaking <think></think> tags in two
ways: (1) the LiteLLM requester only stripped the legacy
CRETIRE_REASONING_BEGINk marker, missing the public <think>
convention used by MiniMax-M3 and similar providers; (2) the
WeCom AI Bot stream channel was being closed as soon as the first
LLM round finalised, so the second-round push (after a tool call)
silently fell back to a markdown reply_text that WeCom does not
render as a collapsible "thinking" block.

This change fixes both:

* LiteLLMRequester._process_thinking_content now strips both
  <think>…</think> and the legacy marker, with a stateful
  _ThinkStripState that handles tags split across streaming
  chunks. LocalAgentRunner._StreamAccumulator exposes the same
  strip as a final-pass safety net and the second-round
  accumulator is no longer seeded with the first round's content
  (which made every intermediate round repeat the opening line in
  the user reply).

* WecomBotWsClient.push_stream_chunk now rotates the stream_id on
  is_final=True instead of tearing down the stream channel. The
  new stream_id lets the next LLM round open a fresh streaming
  message that WeCom renders as its own "thinking" block instead
  of a raw <think> chunk.

* WecomBotMessageConverter.yiri2target no longer drops Image /
  Voice / File components -- it returns a list of per-component
  items, and the adapter routes media through a new upload_media
  (3-step aibot_upload_init / aibot_upload_chunk /
  aibot_upload_finish protocol) + reply_image / reply_file /
  reply_voice path. This unblocks the
  /workspace/outbox/<query_id>/ auto-delivery hook that was
  silently broken because Image components were dropped before
  reaching the SDK.

Tests cover public-think stripping, stream rotation across tool
rounds, and the upload-media / reply-media protocol.

asyncpg returns JSON / JSONB columns as raw strings by default, which
breaks every LangBot code path that expects a dict (mcp server loading,
bot adapter config, pipeline config, etc.) when running on PostgreSQL.

The asyncpg dialect's built-in on_connect hook should install the
codecs, but it does not fire reliably on the SQLAlchemy 2.0 async
engine path. Monkey-patch AsyncAdapt_asyncpg_dbapi.connect so that
each new connection registers json / jsonb codecs eagerly via the
wrapper's run_async hook.

… CoT

This adds two new misc toggles under the pipeline output config and the
plumbing they need end-to-end:

* `remove-empty-think-round` (`zh_Hans` 删除无文本输出的思维链):
  when the LLM emits only chain-of-thought + tool calls in a round
  (no user-visible text), drop the round's `MessageChunk` from the
  stream so the user doesn't see an empty bubble. The tool-call loop
  still runs because `req_messages.append(final_msg)` is unconditional.

* `keep-first-think-only` (`zh_Hans` 除了第一条消息的思维链):
  only effective when `remove-think` is on. Round 1 still streams into
  WeCom and renders as a discrete thinking block; rounds 2+ fall back
  to `reply_text` after their stream entry is popped by the SDK, so
  subsequent LLM rounds no longer allocate a new stream_id and no longer
  render as thinking blocks. This restores the pre-bb89fe7f fallback
  behaviour but only for rounds 2+, restoring the 'single thinking
  block + plain text messages afterwards' UX callers had asked for.

Implementation notes:

* The new `output.yaml` fields are rendered automatically by the
  pipeline form (no front-end change needed).

* `WecomBotWsClient.push_stream_chunk` now keeps an end-of-round
  counter per `msg_id` and consults a caller-controlled
  `fallback_after_round` flag (default 0, meaning the bb89fe7
  rotate-per-round behaviour is preserved). When the counter crosses
  the threshold the stream entry is dropped so the next push fails
  to find it and returns `False`; wecombot.py already falls through
  to `reply_text` in that case.

* `respback.py` and `pipelinemgr.py` stash the pipeline config on
  the platform event (`_langbot_pipeline_config`) so the platform
  adapter can read the misc toggles without growing the adapter
  interface. The adapter pulls the toggles and toggles the SDK's
  `fallback_after_round` flag accordingly.

* `localagent.py` resolves `remove-empty-think-round` the same way
  it already resolves `remove-think` (defensive nested `.get` so
  pipelines missing `output.misc` still parse). The dead-code
  `first_content` assignment removed by this commit was unused since
  the bb89fe7 rebase-accumulator fix.

The ``remove-empty-think-round`` ``keep-first-think-only`` toggles are
independent of the upstream sandbox-attachment delivery path, but
they share the same wrapper code path that was failing in
practice: ``ResponseWrapper._append_outbound_attachments`` only
fired on a ``role='assistant'`` final message. When the agent did
not produce a final assistant text message (which happens often —
e.g. when the LLM immediately issues another tool call after
seeing the tool result), outbox files were never delivered.

This change splits the responsibility in two and moves the
collect trigger to the tool-result branch so every sandbox tool
call can ship its files independently of what the LLM does next.

Wrapper stage (``ResponseWrapper.process``):

* ``_collect_outbound_components`` is the new shared helper.
  It returns ``(components, service_available)`` so callers can
  tell whether the collect was a no-op because the service was
  not configured, vs. because the outbox was actually empty.
* A new ``role='tool'`` branch in ``process`` collects and
  appends attachments every time a tool result reaches the
  pipeline. It deliberately bypasses the
  ``_sandbox_outbound_collected`` at-most-once flag because the
  terminal-assistant branch keeps that semantics for the legacy
  is_final path.
* The legacy ``_append_outbound_attachments`` still sets
  ``_sandbox_outbound_collected`` — but only when the service
  was actually consulted, so an absent service does not poison
  the at-most-once gate on a query that later gains a service.

Box service (``BoxService.collect_outbound_attachments``):

* The host path now quarantines each file it hands out by
  ``os.replace``-ing it into ``<host_dir>/.sent/<rel>``. Future
  collects see the same key on the next walk and skip it, so a
  multi-tool agent that emits one image per tool round gets one
  image per round and never receives the same file twice.
* ``os.walk`` is replaced with a manual ``os.scandir`` stack so
  the walk does not descend into ``.sent`` subtrees that appear
  mid-iteration as a side effect of the move.
* Mid-directory quarantine keys on the full relative path
  (``a/1.jpg`` vs ``b/1.jpg``) so two identically-named files in
  different subdirectories are not confused.
* ``finalize_outbound_attachments`` is a new explicit cleanup
  entry point that wipes the per-query outbox plus the
  quarantine. ``ChatHandler`` calls it once streaming completes
  so the next turn that reuses this ``query_id`` (counter
  resets across restarts) does not inherit stale attachments.
* Exec fallback keeps the read-and-clear semantics (cross
  container rename is not atomic). The host path is the common
  case and is fully multi-collect-safe.

Tests:

* ``tests/unit_tests/box/test_box_outbox_lifecycle.py`` —
  exercises the host quarantine contract directly (covers
  single-shot, subdir disambiguation, inter-collect isolation,
  ``.sent/`` survival, oversize skip, finalize).
* ``tests/unit_tests/pipeline/test_wrapper_tool_attachments.py``
  — exercises the new ``role='tool'`` branch end-to-end through
  a constructed ``pipeline_query.Query``.
* Two pre-existing tests in ``test_box_service.py``
  (``test_outbound_reads_host_and_quarantines``,
  ``test_outbound_quarantine_survives_second_empty_collect``)
  were rewritten to assert the new quarantine layout instead of
  the old read-and-clear behaviour. One obsolete test
  (``test_outbound_empty_clears_stale_host_dir``) was deleted
  because the behaviour it asserted no longer exists.