Function spill_dir 

pub fn spill_dir() -> PathBuf

Get the spill directory for output truncation.

Uses $XDG_RUNTIME_DIR/kaish/spill (RAM-backed tmpfs on systemd systems). Cleared on reboot, user-scoped, survives across MCP calls.