review classifier: classifications of one PR share a cached prefix

On the API key runtime the classifier now hands claude its prompt as one
stream-json user message (`--input-format stream-json`) with two text
blocks: the PR's shared context, carrying `cache_control: ephemeral`, and
the classification's question.

As plain stdin text the whole prompt was one block, and claude puts its
only message breakpoint on the last block, after the question. The cache
writes an entry only where a breakpoint is, so no entry ended at the
shared-context/question boundary. Every classification wrote the whole
prompt and none read it (production: cacheRead ~0, cacheCreation ~input).
The system-prompt prefix (~270 tokens) is under the minimum cacheable
length. Captures against a local listener with a dummy key (claude
2.1.223) show the client breakpoint survives on the shared block, and that
claude adds none there on its own.

The PR stays in the user role: moving it into the system prompt would give
untrusted PR text the system prompt's authority.

`Model::ask` takes a `Prompt { shared, question }`. The ACP runtime joins
it back into the same text it sent before.

Refs #5245

swarm-review-classifier/README.md

@@ -14,7 +14,8 @@ forge and holds no forge credential.
 
 - The shared context first: a system prompt, the PR's commits with their full
   messages, and the diff with lockfiles collapsed as `hive-forge diff` does.
-  Every classification's prompt starts with the same bytes.
+  Every classification's prompt starts with the same bytes, and `claude` gets
+  that part as a content block of its own, with a cache breakpoint at its end.
 - One `claude --print` per classification, with no session, no tools
   (`--tools ""`), no MCP server, its own empty directory and
   `ANTHROPIC_API_KEY` in its environment only.