fix(kimi-cli,kimi-exec): parity batch 7 — doctor stderr, resume work-dir check, goal replace, web flags

- doctor: failure blocks go to stderr, clean stdout on success (TS parity)
- print -S <id>: reject resume when the session work_dir differs from the
  current directory, with the TS cd-hint message (lexical normalize, no fs)
- headless /goal replace: PromptSetup gains goal_replace, plumbed to
  session/goal_create (engine wire already supported the field)
- web: plumb --insecure-no-tls (negated) and --allow-remote-shutdown into the
  Rust server (loopback refusal without opt-in, shutdown route now stops the
  server); --log-level validated then reported unsupported by the Rust server
- tests: doctor stream assertions, resume cross-dir integration, goal
  replace swap/no-swap, web tls/shutdown/log-level

Author: 7723qqq