fix: prevent duplicate streamed tool calls

[lambertjosh]

Summary

• cherry-pick OpenCode #30800 to upgrade the CLI and core OpenRouter provider to 2.9.0
• align Kilo Gateway's direct provider dependency with the same upstream fix

Context

The disabled question dock was caused upstream of VS Code: @openrouter/ai-sdk-provider@2.8.1 could emit the same tool call twice when complete JSON arguments were followed by a trailing whitespace delta. That created two question request IDs for one persisted tool invocation.

Provider 2.9.0 includes OpenRouter #489, which guards against re-emitting a tool call after it has already been sent. This PR intentionally cherry-picks the corresponding OpenCode dependency bump (e45e0e1125) and adds the Kilo-specific gateway pin. The earlier optimistic VS Code workaround is removed from the final diff.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The only change since the previous review (3f9c025) is commit a58ec826 which removes the provider regression test that was added to verify @openrouter/ai-sdk-provider@2.9.0 guards against re-emitting tool calls.

The removal is clean — the test was exercising behavior owned by the upstream @openrouter/ai-sdk-provider package (not Kilo code), and removing it reduces the gateway test surface to only Kilo-owned logic (buildRequestHeaders). The root fix (the provider version bump to 2.9.0) and the VS Code-side workaround removal remain in place from the previous commits.

No new bugs, security issues, or style violations are introduced.

Files Reviewed (1 file, incremental)

• packages/kilo-gateway/test/provider.test.ts — regression test removed, header test intact

---

_{Reviewed by claude-4.6-sonnet-20260217 · 177,370 tokens}

_{Review guidance: REVIEW.md from base branch main}

[lambertjosh]

Validated questions are working reliably for me on Qwen 3.6 Plus.