Remove models.dev dependency and use static model registry

Context

The CLI currently fetches all model/provider metadata from https://models.dev/api.json at startup and on a 60-minute interval. Our harness will never use this external API — we control which models we support. This adds unnecessary network dependency, a 1.3MB test fixture, and build-time fetching for a snapshot file.

Proposal

Replace the ModelsDev integration with a static TypeScript model registry that we maintain directly.

What to delete

packages/cli/src/provider/models.ts — the entire ModelsDev namespace (~133 lines)
models-snapshot.ts generation block in packages/cli/script/build.ts (~20 lines)
3 flags in packages/cli/src/flag/flag.ts: AICTRL_MODELS_URL, AICTRL_MODELS_PATH, AICTRL_DISABLE_MODELS_FETCH
models --refresh CLI option in packages/cli/src/cli/cmd/models.ts
packages/cli/test/tool/fixtures/models-api.json (1.3MB test fixture)
models-snapshot.ts from .gitignore
Related env vars from turbo.json passthrough (MODELS_DEV_API_JSON, AICTRL_MODELS_URL)

What to rewrite

File	Change
`packages/cli/src/provider/provider.ts`	Replace `ModelsDev.get()` + `fromModelsDevProvider`/`fromModelsDevModel` in `state()` with a static import. `CUSTOM_LOADERS`, config merging, and auth logic stay as-is.
`packages/cli/src/config/config.ts` (lines ~932-953)	`Config.Provider` extends `ModelsDev.Provider.partial()` — replace with a standalone Zod schema
`packages/cli/src/cli/cmd/auth.ts` (3 calls)	Replace `ModelsDev.get()` with `Provider.list()` for provider name display in CLI pickers
`packages/cli/src/cli/cmd/github.ts` (1 call)	Same — replace with `Provider.list()`
`packages/cli/test/preload.ts`	Remove `AICTRL_MODELS_PATH` injection, provide static test data

What stays untouched

packages/cli/src/provider/transform.ts — operates on Provider.Model, no ModelsDev dependency
Session, plugin, bus, and all other subsystems — no direct imports

Replacement

A static TypeScript file exporting Record<string, Provider.Info> with only the models we support. This becomes the single source of truth instead of an external API.

Additional scope found while auditing the headless run path. Tracked under the headless optimisation epic.

Not in the lists above:

provider/transform.ts:6,10 imports ModelsDev types (the Modality enum), so it is not untouched.
cli/cmd/run.ts:118-124 (attachedContextLimit) reads limit.context straight from the raw ModelsDev data.
config/config.ts:37: the ModelId $ref points at https://models.dev/model-schema.json. The generated SDK ProviderConfig (packages/sdk/src/gen/types.gen.ts) carries models.dev field names, so the standalone config schema must stay field-compatible or user configs break.
cli/cmd/github.ts does delete p["github-copilot"] on the shared cached object.
turbo.json (MODELS_DEV_API_JSON, AICTRL_MODELS_URL), nix/opencode.nix, CONTRIBUTING.md:30 (says to add providers upstream at models.dev) and EVENTS.md:229.
test/preload.ts doesn't set AICTRL_DISABLE_MODELS_FETCH, so the test suite makes real network calls today.

Problems the removal also fixes:

models-snapshot.ts is gitignored and regenerated on every build: 3.9 MB, 192 providers, 6,841 models. Releases are not reproducible.
The aictrl provider is missing from the snapshot, so its CUSTOM_LOADERS entry logs "Provider does not exist" on every start, and its priority and hint in the auth picker are dead code.
Models added in code with ??= (GLM-5.3, gpt-5.3-codex) are overridden by models.dev data once upstream lists them. GPT-5.6 exists only because models.dev has it.
The cache at ~/.cache/aictrl/models.json takes precedence over the bundled snapshot, so a stale or tampered cache wins.

Decision needed:

About 170 providers work today with only an env var set. Proposal: curate the 21 CUSTOM_LOADERS providers, plus aictrl and the codex/GLM models. Everything else is defined through config.provider (openai-compatible).
That is a behaviour change, so it needs a minor bump, not a patch.
Keep the catalog in Provider.Model shape, which removes fromModelsDevProvider/fromModelsDevModel.
Replace the 1.4 MB fixture with a small test catalog.

Decision (2026-10-17): the curated catalog covers the 21 CUSTOM_LOADERS providers, the aictrl provider and the codex/GLM models. Any other provider has to be defined in config.provider (openai-compatible). This is a behaviour change, so it ships as a minor version bump.