feat: Add parallel chain to extract and inject initial user prompt

[cafechen]

• Add readFileHead(), extractFirstUserMessage(), and getCurrentSessionInitialPrompt() functions
• Extract first USER message from current session file (Cursor/OpenClaw)
• Inject initial user prompt into GEP prompt context and metadata
• Store initial_user_prompt in prompt artifact metadata and solidify state
• Support both Cursor transcripts and OpenClaw session files as data sources
• Maintain audit trail for original user intent throughout evolution cycle

[autogame-17]

Thanks for the PR @cafechen! The core idea -- capturing the initial user prompt as "original intent" for GEP context -- is valuable and the direction is right. However there are a few issues that need to be addressed before merging:

1. Fatal Bug: initialUserPrompt used before declaration

const initialUserPrompt = getCurrentSessionInitialPrompt() is declared after it is referenced in the writeStateForSolidify state object. Since const has a temporal dead zone, this will throw ReferenceError: Cannot access 'initialUserPrompt' before initialization every time run() reaches that point.

Fix: move const initialUserPrompt = getCurrentSessionInitialPrompt() to before the state object construction (before writeStateForSolidify).

2. Privacy risk: do not publish initial_user_prompt to Hub

The three additions in solidify.js inject initial_user_prompt into Capsule and EvolutionEvent payloads that get published to the Hub. User prompts may contain sensitive information (project paths, API keys, business logic, personal data). Once published, any agent can fetch this data.

Additionally, the Hub's payloadSanitizer.js does not include initial_user_prompt in CAPSULE_ALLOWED_FIELDS or EVENT_ALLOWED_FIELDS, so the field will be silently stripped anyway.

Recommendation: keep initial_user_prompt local only -- in GEP prompt context and solidify state. Remove the three additions in solidify.js.

3. Variable shadowing in extractFirstUserMessage

function extractFirstUserMessage(content) {
  // ...
  const content = msg.content; // shadows parameter 'content'

Rename to const msgContent = msg.content to avoid confusion.

4. SESSION_SOURCE === 'auto' handling

getCurrentSessionInitialPrompt() only checks for cursor and falls through to OpenClaw for everything else. The existing readRealSessionLog() treats auto mode as OpenClaw-primary with Cursor fallback. The new function should follow the same logic for consistency.

5. Minor: narrative comments

Remove the // New: prefixes on the three functions -- they are narrative comments that will become stale.

---

Summary: the approach is sound. Please fix the temporal dead zone bug, remove initial_user_prompt from the publish payloads in solidify.js, address the variable shadowing, and align SESSION_SOURCE handling. Happy to merge once these are resolved!