Add shared provider routing and Z.AI host-model profiles

[provos]

Provider profiles currently require service-specific branches throughout harness adapters, host models, and editors. This adds direct Z.AI profiles and independent host-model bindings behind shared built-in provider definitions, so those consumers receive protocol bindings and safe configuration descriptors.

• Built-in definitions own protocol bases, independently declared endpoint allowlists, credential bindings, model metadata, compatibility policies, and editor options. Opus/default uses GLM 5.3; Sonnet/Haiku uses GLM 5.3 Flash, with z-ai/ namespaced IDs on OpenRouter.
• One pure mapper owns precedence and request/selection provenance. Direct Docker clients select before invocation; OpenRouter maps fresh request IDs once at the proxy; host SDKs select directly. Chained maps no longer apply twice, per-agent targets remain terminal, and command overrides use the same stage boundary.
• Claude Code, Codex, and Goose translate neutral bindings into their own env, argv, TOML, and catalogs. Host credential resolution and proxy-cost policy also consume provider definitions. Native authentication and OAuth refresh are preserved. A private OpenRouter hook fills missing Goose Anthropic cache checkpoints and Google message reasoning fields after routing, preserving existing fields and ordinary nested tool metadata. Main and auxiliary requests remain proxy-routed without new collision restrictions or a routing marker.
• CLI and web editors use backend-supplied provider options/defaults/catalog support. Backend validation derives from the built-in profile schemas; key masking, file/environment credential origin, omitted versus empty maps, routing constraints, and atomic default/host-role renames remain host-owned. Catalog refresh/reopen and service-switch races are covered.
• hostModelProfiles independently binds agent, policy, prefilter, summary, and autoApprove roles. Builtin budget enforcement uses the effective host model, including session overrides, while SDK creation retains the original request so maps apply once. Auto-approval remains disabled by default. Z.AI JSON-mode structured output retains SDK validation and human escalation on invalid output.

Validation includes 576 focused core tests, 86 UI tests, 18 hermetic TLS proxy tests, and an installed Claude Code turn against a dummy local upstream. Final infrastructure/credential changes additionally passed 150 focused tests. The final prompt/Goose corrections passed 188 focused tests and 19 hermetic TLS tests, with three read-only simplify reviews clear. A full-branch simplify pass additionally covered all 70 files and found one builtin budget identity mismatch, now corrected and re-reviewed; 208 focused caller/model/budget tests passed for that fix. TypeScript, source/UI lint, formatting, cycle checks, production build, and commit/push hooks are checked. A test-only compatible definition exercises all three harness generators, host credential resolution, and the fixed CLI/web editors; persisted configuration still rejects custom provider types and endpoints.

The OpenRouter Codex catalog uses its emitted startup wire identity with selected-model metadata, otherwise conservative 200k/text-only capabilities. This applies to emitted entries: uncataloged command override IDs retain pinned Codex's own 272k/text+image unknown-model fallback, as before this refactor. Direct Z.AI retains the qualified GLM 5.3 catalog entry; Flash context/multimodal behavior remains unqualified. Goose compatibility does not reconstruct metadata omitted by error/frontend tool formatting or repair the pinned streaming parser's pre-existing metadata loss; effective-auxiliary cache formatting is qualified separately from literal SDK parity in the design document.

Earlier user-authorized Coding Plan hello-world checks returned HELLO_FROM_ZAI for all three harnesses using GLM 5.3. Claude Code and Goose observed served GLM 5.3/HTTP 200; Codex completed but its served identity remains unverified because capture ended with one aborted exchange and no final record. Flash, standard API-plan access, full tool loops, host-role live calls, cache/context behavior, and benchmark completion are not qualified by those short checks. See docs/designs/zai-provider-profiles.md for architecture and qualification details.

User-defined compatible providers/endpoints and workflow benchmark changes are deferred.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.