feat(providers): add Tailscale Aperture and model-aware inference controls

[lefoulkrod]

Summary

• add Tailscale Aperture as a first-class, no-token provider with automatic model and wire-API discovery
• make inference controls, thinking levels, context capacity, and role defaults follow provider/model metadata
• sanitize stale or unsupported profile options in the UI, runtime, specialized model roles, and provider request boundary
• use discovered cloud context capacity and provider-reported token usage for the context meter
• rebase onto origin/main at 73cf1d53 and adapt the feature to the new agent_core / runtime package boundaries

Aperture

OmniDeck now accepts the Aperture gateway root URL and uses the caller's Tailscale identity instead of requiring an API token. It discovers granted models from /v1/models, combines them with /api/providers, and routes each model through the richest compatible adapter:

• OpenAI Responses
• Anthropic Messages
• unsigned Anthropic Bedrock invoke
• OpenAI Chat Completions fallback

The picker keeps provider-qualified IDs internally while showing the model, upstream provider, wire API, context, vision, and thinking capabilities in the UI.

Model-aware UX

• unsupported controls are hidden and cleared when the provider/model changes
• GPT reasoning models do not expose or receive unsupported temperature/top-p overrides
• Bedrock Claude requests do not receive SDK-unsupported sampling fields
• thinking renders as a supported level selector when levels are available, otherwise as a toggle
• presets contain only applicable fields and presets with no effect are hidden
• cloud context capacity is detected and read-only; local Ollama retains runtime context allocation
• vision, compaction, and title roles use detected defaults, bounded output caps, and compatible overrides

Provider metadata is authoritative when available. agent_core/providers/model_metadata.json is the centralized fallback for APIs that return sparse model descriptors.

Compatibility and safety

• existing saved profiles are sanitized at execution time, including root agents, spawned agents, and routine tasks
• legacy Ollama-shaped vision/compaction defaults migrate back to Auto
• request-boundary guards remain in place for discovery failures and direct adapter callers
• Aperture discovery results are cached and can be explicitly refreshed

Verification

• just unit: 2,005 passed
• just integration: 69 passed
• just test-ui run: 788 passed
• just check: Ruff, ESLint, mypy, TypeScript, release-note, and container/workflow policy checks passed
• GitHub CI: all required checks passed
• Apple Silicon image pulled back from GHCR and smoke-tested as aarch64, including the Aperture import and packaged fallback metadata

Preview images:

ghcr.io/omnideck-dev/omnideck:aperture-preview-arm64
ghcr.io/omnideck-dev/omnideck:aperture-preview-arm64-20260911

The previously distributed aperture-preview-arm64-20260904-spawnfix tag was also refreshed to the same manifest so existing pinned installs can update in place.

Manifest digest: sha256:3121b4353ee162d9cfd66054f6ff0293a1997920c7114bf2a8cdfb2844ffc8ff.

Related

Fixes #152.

Supersedes #361 once this PR merges; #361 should then be closed with a link back here.