fix(code-review): preflight follow-ups

[alex-alecu]

Why

Follow-up code reviews could try to reuse an old agent session even when its sandbox was gone or its last run was stuck. That could make a new review fail instead of starting clean.

What changed

Follow-up reviews now check the old agent session before using it. The check makes sure the sandbox can still be reached and that any active run is not stale. If the old session is not safe, the review starts a fresh session instead of changing the old one or sending it a new message. The health check is also exposed through the shared worker client so other workers can call it in the same way.

How to test

1. Run pnpm --filter @kilocode/worker-utils test -- cloud-agent-next-client.test.ts.
2. Run pnpm --filter cloud-agent-next test -- src/router.test.ts.
3. Run pnpm --filter kilo-code-review-worker test.
4. Run pnpm --filter @kilocode/worker-utils typecheck.
5. Run pnpm --filter cloud-agent-next typecheck.
6. Run pnpm --filter kilo-code-review-worker typecheck.
7. Run pnpm format.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/code-review-infra/src/code-review-orchestrator.ts
• services/code-review-infra/test/integration/code-review-orchestrator.test.ts

---

_{Reviewed by gpt-5.5-20260423 · 626,870 tokens}

[alex-alecu]

Manual test passed.

Tested:

• Started local code-review service group and verified cloud-agent-next health endpoint.
• Sent direct getSessionHealth preflight requests for invalid auth and a missing previous cloud-agent-next session.
• Triggered a v2 follow-up review request with previousCloudAgentSessionId pointing at a missing session.
• Retried with a persisted local user so fresh fallback could create a cloud-agent-next session and start execution.

Verified:

• Invalid auth returned 401 from /trpc/getSessionHealth.
• Missing previous session returned 404 NOT_FOUND from /trpc/getSessionHealth.
• The code-review orchestrator logged the health preflight failure and did not call sendMessageV2 for the missing previous session.
• The follow-up review fell back to prepareSession + initiateFromKilocodeSessionV2 and reached running with a fresh cloudAgentSessionId, cliSessionId, and executionId.
• The fresh cloud-agent-next session persisted locally enough for session-ingest/cli_sessions_v2 creation and sandbox workspace setup.