fix(opencode): add GPT routing alongside OSS discovery

[dgokeeffe]

Summary

Adds the OpenCode routing and discovery follow-up on top of #223.

Changes

• Add the databricks-openai provider so GPT-5, GPT-5.6, and Codex models use the Databricks Responses API alongside the databricks-oss provider.
• Discover Codex models for OpenCode and emit their provider configuration.
• Fall back to AI Gateway foundation-model serving endpoints when UC model-services does not expose the validated GLM/Kimi models.
• Apply the same GLM/Kimi allowlist to fallback discovery so Claude, Gemini, Inkling, and other MLflow-dialect endpoints are not misclassified.

Review scope

This branch is stacked on #223. The incremental change is one commit across the OpenCode/discovery implementation and focused tests:

636c3b6...3f1c227

The parent PR no longer contains the rejected proxy or broad OSS cohort.

Validation

• Final changed-area suite — 588 passed, 29 workspace-gated skips
• uv run ruff check . — passed
• uv run pytest --ignore=tests/test_e2e_user_agent.py -q — 1062 passed, 36 skipped

The installed-agent User-Agent capture module was excluded from the full run because local Claude/Pi installations can return from existing managed state without contacting its capture server; all affected routing and rendering paths are covered by the focused tests above.

Replaces the larger consolidated #238 with a clean linear stack.

[dgokeeffe]

This stack has been rebuilt on current main with one clean commit per layer. The incremental OpenCode diff is linked in the description; the rejected proxy and broad OSS cohort are gone. Local focused validation is 480 passing with Ruff clean. A maintainer CI approval/review is now the remaining gate.

[dgokeeffe]

Post-review update: OpenCode GPT entries now carry shared context/output limits and prefer the newest eligible GPT; foundation endpoint parsing is defensive against malformed records; CLI fallback tests are deterministic; and the live e2e fixture now populates OpenAI/OSS models and isolates Pi settings paths. Round-3 reviewers found no production blocker; final validation is 588 passed/29 skipped focused and 1062 passed/36 skipped excluding environment-sensitive installed-agent capture tests.