Cursor Agent7/1/2026, 10:30:21 PM

The provider model discovery cache commit made every static-catalog provider
pass unknown model ids through, which broke config startup resilience,
selection-time validation, persisted-session migration, and child model
routing (11 red tests on main).

Restore a coherent contract:
- sync paths (normalizeModelIdForProvider) keep discovery passthrough but
  reject ids provably registered to a different provider family
- async selection paths (resolveModelMetadata without allowPlaceholder) are
  strict: static registry plus the on-disk model discovery cache
- config load falls back to the provider default with a warning again for
  unknown, non-discovered model and preferred-child ids
- persisted sessions migrate unsupported/aliased ids again for static-catalog
  providers; lmstudio/bedrock/codex-cli stay passthrough via
  isRuntimeDiscoveryProvider
- gemini-* joins the model/provider mismatch heuristic with google guidance

Also pins env in the connection-catalog oauth_pending test so ambient
provider API keys cannot flip providers to connected.

Co-authored-by: Max Weinbach <mweinbach@users.noreply.github.com>

Parentd022081