feat(models): discover Claude models from a remote manifest

[rynfar]

Two upstream commits, in order:

• #9078 add Claude Fable 5.1
• #9084 discover Claude models from a remote manifest

Claude's model list stops being 500 hand-maintained lines in ClaudeProvider.ts
and becomes data in model-manifest.json, resolved through a new
ClaudeModelCatalog. Net −1029 lines across the pair.

#9078 is not subsumed

I had this filed as "skip, subsumed by #9084." That was wrong. #9084 never
touches packages/contracts/src/model.ts, so skipping #9078 would have dropped
the Fable 5.1 slug aliases entirely and left Pylon's manifest on claude-fable-5.

Carve-outs

checkClaudeProviderStatus param collision. Pylon added a 5th parameter
resolveUsage for the composer capacity gauge; #9084 adds a 5th parameter
modelCatalog. Taking upstream's positionally would have silently dropped the
usage probe. Pylon's stays 5th, the catalog is 6th, and the ClaudeDriver call
site now uses upstream's sequencing — manifest first, since the catalog shapes the
probe rather than post-processing its draft — while carrying Pylon's
usageProbeCache / retainUsageLimits chain and the HttpClient service it needs.

Manifest schema hardening. The manifest is fetched over the network, and Pylon
had bounded it: non-empty and length-capped driver kinds and slugs, a cap on
models per provider and providers per manifest, a supported-driver allowlist, and
onExcessProperty: "error". Upstream's #9084 rewrites the same struct as
Schema.Record(Schema.String, Schema.Array(Schema.String)) with none of that.
All of Pylon's checks are kept and upstream's providers catalog plus its
reference validation added alongside.

That combination has a trap. Moving onExcessProperty: "error" onto the envelope
is not enough — the annotation does not survive .pipe(Schema.check(...)), so the
guard silently stopped applying and a payload with an unknown internalNotes
field was accepted. Pylon's own "rejects otherwise valid payloads with non-public
metadata" test caught it. The annotation now sits on the schema that actually
decodes.

providerModels.ts takes upstream's manifest-aware resolveSelectableModel
while keeping Pylon's background-text-generation capability branch.

Retired test. #9084 empties the Claude alias table in contracts, because
aliases now live in the manifest (verified: fable, opus, and the rest are all
present under providers.claudeAgent.models[].aliases, and
ClaudeModelCatalog.test.ts covers alias resolution). The normalizeModelSlug
assertion for Claude was therefore testing a retired path and is dropped. Pylon's
"Prime Agent default model availability" suite in the same file is kept.

Verification

t3, @t3tools/web, @t3tools/shared, @t3tools/contracts typecheck clean.
Lint clean. 1428 server provider tests, 601 web tests, 11 shared model tests
passing — including both Pylon's manifest-rejection suite and upstream's new
last-good-cache suite, which were unioned rather than one replacing the other.

Model: Claude Opus 5 in Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	−1 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+11 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.6 KiB	−12 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.2 KiB	57.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	−11 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+9 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.6 KiB	−20 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.1 KiB	58.1 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: a509639 · PR result: a9c86c4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.5 KiB
• Claude decoded thread snapshot: 110.2 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.