fix(gateway): Recognize Claude Code opening reminders

[BYK]

Summary

Claude Code 2.1.289 sends coding turns with no project path in the system field. Lore classifies them as side channels and skips memory and persistence. This change recognizes the project instruction file in the first user message's opening system reminder for tool-bearing coding turns.

Changes

• Use the same opening reminder for routing and project attribution, while leaving tool-less classifier and naming calls untouched.
• Ignore global Claude Code instructions; reject ambiguous instruction paths and conflicting project headers with a fixed 400 response.
• Add failing-first remote-gateway tests for stored coding turns, project-scoped memory isolation across two sessions, stale headers, and classifier passthrough. Removing each guard made its regression fail again.

Validation

Five relevant suites: 306 tests passed. UI: 823 tests passed. Typecheck, lint, formatting, and gateway bundle passed; three real-boundary cases passed 10 repeated runs. The full local test run timed out with an embedding model initialization failure; exact-head CI is required. Metadata-only confirmation of the first text block's reminder placement and classifier tool count is still pending; no request bodies, paths, or tokens were collected.

[github-actions]

Coverage Results 📊

✅ Patch coverage is 100.00% (64 of 64 changed executable lines covered; target 80%).
Project statement coverage is 85.87% (up 0.02 percentage points from base (350ef78) to head (d010af2)).

Changed files with executable lines (3)

File	Patch coverage	Changed executable lines
packages/gateway/src/side-channel.ts	100.00%	27/27 covered; partial branches: 86, 92, 93, 118
packages/gateway/src/config.ts	100.00%	26/26 covered; partial branches: 1292
packages/gateway/src/pipeline.ts	100.00%	11/11 covered

Coverage diff

@@            Coverage Diff             @@
##          main     #2003       +/-##
==========================================
+ Coverage    85.85%    85.87%    +0.02%
==========================================
  Files          338       338         —
  Tracked lines     52914     52971       +57
  Branches     44616     44704       +88
==========================================
+ Hits         45429     45486       +57
  Misses        7485      7485         —
- Partials      4625      4630        +5

---

Generated by Coverage Action

[sentry]

Bug: The project path conflict check incorrectly rejects valid subdirectory reminders if the initial project path was set by a reminder instead of a header, as headerPath is undefined.
_{Severity: MEDIUM}

Suggested Fix

The exemption logic should be updated to allow subdirectories of the established project path, regardless of whether it was set by a header or an initial reminder. The check should validate that the later path is a subdirectory of result.path, not just headerPath. A simple fix would be to check if later.path.startsWith(${result.path}/).

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: packages/gateway/src/side-channel.ts#L126-L129

Potential issue: In `getRequestProjectPath`, the logic for handling project path
conflicts in subsequent messages contains a flaw. The exemption for subdirectories is
only applied when an explicit `x-lore-project` header is present. If the initial project
path is established by a reminder in the first message (making `headerPath` undefined),
the exemption condition `headerPath === result.path` will always fail. This causes the
system to incorrectly throw a `ProjectPathConflictError` when a later message
legitimately refers to a subdirectory of the established project, which should be a
valid operation.