feat(signature): identify Kimi thinking signatures by fixed size

Kimi Messages responses carry a thinking signature that no existing
validator claims, so replayed Kimi history resolved to the residual
unknown class and lost its provider policy.

Kimi exposes no self-describing envelope: a per-offset scan over the
observed corpus finds no magic prefix, version byte or key id, so the
GPT, Claude and Gemini probes have nothing to anchor on. The one stable
signal is raw length, which is fixed per protocol mode at 12946
characters for non-streaming and 4340 for streaming, and is independent
of the content it accompanies. This is not bucketing of a variable
payload: a response whose thinking text grew from 6 to 14803 characters
emits a byte-identical length, and a non-streaming response carrying a
single thinking token still emits the full 12946.

Because size is the only signal, the probe runs after every
self-describing envelope check has declined. A length coincidence then
cannot capture another provider's signature, and future drift in Kimi's
sizes costs Kimi its own identification instead of corrupting a
neighbouring family. Replaying the cross-provider catalog confirms the
existing families are unaffected.

The envelope pre-filter now gates only the envelope probes rather than
returning early. Kimi's base64 is uniformly distributed and starts with
one of "CERg" about 6% of the time, so an early return dropped those
payloads on whichever side of the gate they happened to land.

A Kimi target drops only the signature rather than the whole block:
the upstream returns 200 for a mutated, truncated, non-base64 or
entirely absent signature, because reasoning continuity there travels
in OpenAI-style reasoning_content. Dropping the block would discard
recoverable thinking text for no upstream benefit.

Contract tests synthesize payloads from a seeded PRNG, since length and
entropy need no captured traffic. Corpus-backed tests validate against
real harvested samples and skip when the corpus is absent, matching how
the Grok and Gemini native corpora are already handled.