Isolate Kimi runs: no cross-project threads, memory, or workspaces #671

Problem

Kimi threads in one Solenta project can see and act on other projects (files, memory, and thread tools). A run must stay inside its own project.

Why

Kimi has no per-invocation MCP config. Solenta merges coder-memory and coder-threads into the user-global ~/.kimi-code/mcp.json, and the CLI also keeps a global workspaces.json of every directory it has ever opened (including $HOME and /). Combined with:

1. threads_list returning every project, and the spawn guard being a self-declared projectId (issue Cross-project spawns: a thread can start workers in another project's repo #109 leftover)
2. Memory MCP treating an omitted project as "all projects"
3. One workspace-wide bearer token with no caller identity

a Kimi agent can list foreign threads, search foreign memory, and drive tools registered for other workspaces.

Claude/Codex already get a Solenta-owned MCP file per launch. Kimi (and Grok) do not. Kimi 0.38 honors KIMI_CODE_HOME, which is the per-run overlay.

Plan

1. Isolated KIMI_CODE_HOME per Solenta Kimi run — copy config.toml, symlink credentials/sessions, write a fresh mcp.json with only Solenta servers, write workspaces.json containing only this cwd. Do not inherit the user's other MCP servers or workspaces. Do not copy AGENTS.md.
2. Bind MCP URLs to the run — coder-threads?projectId= and coder-memory?project= so the server, not the model, owns the scope.
3. threads_list is per-project — required projectId, returns only that project. Bound sessions ignore a claimed foreign id.
4. Memory MCP honors the bind — search/bootstrap/store/recent scoped to the bound project; a claimed other project is rejected.

Grok still uses user-global grok mcp add -s user (same class of hole). Out of scope here.

Check

• Isolated home's mcp.json has only Solenta servers and scoped URLs; workspaces.json has only the run cwd; source AGENTS.md is absent.
• threads_list without projectId errors; with p1 omits p2 threads.
• Bound ?projectId=p1 rejects thread_fork of a p2 thread even when args claim p2.
• Bound memory search does not return another project's entries; claiming a foreign project throws.