fix: refresh provider SDKs and pricing with truthful budget settlement

[blisspixel]

Provider prices and API contracts had drifted, and attended OpenRouter clipped overrun charges and serialized price limits at the wrong level. This updates the locked provider SDKs, uses guarded HTTPX2 transports where required, records full charges through durable settlement, fixes price-limit nesting, rejects unknown billing identities and handles non-finite operator ceilings safely. Key-check guidance respects the default $5 ceiling and preserves existing operator settings.

The dated catalog adds eight reviewed public model candidates while keeping them excluded from automatic routing. Defaults and frozen expert comparisons remain pinned. README, AGENTS and living-expertise acceptance gates require preparation, contextual attribution, explainable revision, reasoned dissent and calibrated uncertainty. This is v2.50.23 maintenance, with no new spend authority or demonstrated expert-quality claim.

Published Python and frontend dependency advisories are patched without suppressions. Explicit parser and KaTeX overrides preserve existing parent plugins; regression tests verify typography, Markdown math rendering and trust refusal. The frontend archive is regenerated, and plugin checksums use the package's required LF bytes on both Windows and Linux.

Validation on final head eefcf5e: all hosted checks pass. Python 3.12, 3.13 and 3.14 each pass 12,508 unit tests, with 85.13%-85.21% combined statement/branch coverage and independently enforced 80% gates. Ruff, strict mypy, ratchets, paid-boundary checks, documentation consistency, core installation, plugin packaging and CodeQL pass. Frontend lint, 87 tests, build and 96 synthetic browser checks pass. Python and npm audits report zero known vulnerabilities.

Failing-before/passing-after regressions cover billing identity, price serialization, overrun accounting, NaN ceilings and key guidance. Real SDK serialization is exercised through offline transports. The full Windows candidate recorded 85.46% coverage, 12,514 passes and two old-price fixture failures; the corrected expectations and final CLI changes pass 113 focused Windows cases. Those earlier failures are retained rather than recorded as a green full Windows run. Fresh full hosted CI validates the complete final diff.

Public OpenRouter metadata admits six existing proposals and refuses the absent pinned DeepSeek endpoint. No paid inference calls were made. The next product gate remains the blinded four-arm local comparison and accountable human review.

Exact-head CI