Give deployment default model providers one home and close the self-hosted model gap

[SaladDay]

Summary

Phase 3 PR A of the new-user install work. Model credentials get one visible home, and the self-hosted model gap found in the boundary release acceptance is closed.

• Deployment default model providers become a runtime setting, managed with the Core key:
  • GET /core/v1/harnesses lists the harnesses with enabled, default and each harness's deployment provider (safe view).
  • GET/PUT/DELETE /core/v1/harnesses/{harness}/model-provider: the PUT body is exactly x_agents_core.model_provider.
  • Keys are write-only, never returned, and encrypted with a new credential purpose bound to the harness.
  • Writes are audited with a deployment-level scope (project_id: null).
  • Migration 000076_deployment_model_providers adds the table and the nullable audit scope.
• Precedence: Session request provider, then saved Agent provider, then deployment default.
  • The default applies to openai_hosted and to Sessions without an environment, never to self_hosted.
  • The resolved provider is frozen into the Session's encrypted snapshot at creation, so changing or removing the default never affects existing Sessions.
• AGENTS_API_EXECUTION_OPTIONS_FILE is retired. Setting it, even empty, stops Core at startup and points to Web (System) or PUT /core/v1/harnesses/{harness}/model-provider.
• self_hosted Sessions may carry caller model credentials, in the request or on a saved Agent. They go only to that Session's bound executor, over the existing daemon channel.
• Fail fast: creating an openai_hosted or self_hosted Session with no resolvable provider returns 400 model_provider_required, param x_agents_core.model_provider. Before, it silently fell back to Codex's built-in provider and hung. Pending input from before the upgrade settles as failed with model_provider_required instead of looping.
• Idempotency:
  • Retries of hosted Sessions record caller intent.
  • Sessions without an environment keep the documented default-retry equivalence; the deployment default is left out of the request hash.
  • Caller-supplied keys enter stored retry hashes only as a fingerprint keyed by the credential key.
• Client: listHarnesses, retrieveHarnessModelProvider, setHarnessModelProvider, deleteHarnessModelProvider, CoreHarness and HarnessModelProvider, with strict projections.
• Pre-upgrade check: deploy/install/model_provider_sessions.py is a read-only count of legacy hosted and self-hosted Sessions that have no frozen provider.

Review

• Independent blind review of the full diff: no P0 or P1. The P2 (idempotency of Sessions without an environment) and the P3s were fixed.
• The fix introduced a keyed fingerprint, so it got its own focused review. That found no P0 or P1. Its P2 (default-retry equivalence) and P3s were fixed in e72acdd2, verified by tests, the native verifier and the gate.

Verification

• Full local server gate on 2cc35bed (the exact head, including main 31b64e38): passed. Playwright browser cases were skipped on the server (Chrome unavailable; approved skip).
• Native verifier: three native-default retries return the original Session after the default is rotated and after it is removed. The test needs one local edit because of an unrelated breakage on main since Use the colocated daemon as the V1 user-managed executor #8; that is tracked separately.
• Real check on an isolated mx1 install (Kimi only):
  • route security holds;
  • a hosted Session with no provider runs on the deployment default;
  • freezing holds when the default changes;
  • with no model configured anywhere, creation fails fast;
  • self-hosted runs work with a request provider and with a saved-Agent provider;
  • the model key is not visible inside the sandbox;
  • audit rows have a null Project;
  • the pre-upgrade count is correct.

Compatibility and ops

• Operators using AGENTS_API_EXECUTION_OPTIONS_FILE must remove it and set deployment defaults in Web or with the new route. A one-time import through parsar apply follows with phase 1b.
• Retry conflicts: retries of key-bearing requests first sent before this release conflict once. Key-bearing retries also conflict after a credential key change, which is not supported anyway.
• Legacy hosted and self-hosted Sessions with no frozen provider must be recreated; run the pre-upgrade check first.
• A dev or preview database that ran this branch while the migration was numbered 000075 must be reset.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}