fix(models): read model metadata from the live GonkaGate catalog

[Dankosik]

What changed

This PR no longer adds a model. It removes the repository's hardcoded model
metadata and makes the installer read everything from the live GonkaGate
catalog.

Hardcoded before

• CURATED_MODEL_REGISTRY in src/constants/models.ts: four checked-in model
  ids with pinned display names and context windows
  (262_000 for Kimi, 205_000 for MiniMax, 262_000 for Qwen), several of
  which already disagreed with the live catalog.
• A checked-in recommended: true flag that acted as the default model.
• Every generated provider.gonkagate.models.<id> entry got
  limit: { context: 0, output: 0 }, so a live-catalog run told MiMoCode that
  every model has a zero context window.
• docs/model-validation.md and docs/how-it-works.md carried a second copy of
  the catalog, including per-model context windows.
• CONTRACT_METADATA.curatedRegistryPublished.

Read live now

GET /v1/models (Bearer auth) is the only source for:

• model ids and their order
• name -> the MiMoCode model display name and the picker label
• description -> picker description
• context_length -> provider.gonkagate.models.<id>.limit.context
• the default model for --yes, which is data[0], the first entry in
  response order. No client-side ranking, sorting, or preference heuristic, and
  no checked-in default model id.

src/constants/models.ts is now types only; the package-contract test fails if
a model id, a numeric context value, or a recommended flag reappears in it.

Behavior against a gateway that has not shipped PR #70

The compatibility window is handled first, not after. Only id is required.
Each optional field degrades independently, and null, wrong types, and blank
strings are treated exactly like "absent":

Field	Missing / null	Result
name	yes	display name falls back to the model id, as today
description	yes	omitted from the picker
context_length	yes	no limit block is written at all

The context fallback is the important one: the installer writes no limit
block instead of context: 0, so MiMoCode keeps its own default rather than
being told the model has a zero-size context window. When a limit is known,
both keys are written ({ context: <live>, output: 0 }) because that is the
exact shape proven against MiMoCode in the workflow proof ledger.

Both context_length and contextLength are read, so a camelCase gateway
response also works.

Deliberate non-changes

• src/constants/model-validation.ts is kept as-is. It is a real MiMoCode
  workflow proof ledger for moonshotai/kimi-k2.6, not catalog metadata: it
  holds no context window, no display name, and no default. It does not feed
  selection or config writes. No record was added for any other model, because
  no such validation run happened.
• Stale qwen/qwen3-235b-a22b-instruct-2507-fp8 prose elsewhere in the repo is
  left alone.

Validation

Command	Result
npm ci --no-audit --no-fund	pass, 45 packages
npm run typecheck	pass
npm test	pass, 89 tests, 0 fail
npm run format:check	pass
npm run package:check	pass (build + publint + package smoke)
npm run ci	pass (all of the above)

Baseline on this branch before the change was also green (82 tests), so the
7 new tests are net new coverage: legacy id-only catalog, enriched catalog,
null/blank/wrong-typed metadata, positional default, picker labels, and an
end-to-end session assertion on the generated provider.gonkagate.models.

🤖 Generated with Claude Code

[Dankosik]

Follow-up: curated recommendation reverted to a validated model

The first revision of this PR marked deepseek-ai/deepseek-v4-flash-0731 as the recommended curated entry while leaving it validationStatus: "candidate". That was wrong in three ways, and ddc4b14 fixes it:

1. The flag was inert. Every consumer of the recommended concept filters on validated before it ever reads recommended — src/install/selection.ts builds validatedModels first, createCuratedModelIndex applies the isValidatedModel guard first, and src/install/managed-provider-config.ts refuses to write non-validated entries. The change did not make DeepSeek the curated default; it only removed the existing one.
2. It caused a type regression. With Kimi demoted, RecommendedValidatedCuratedModel collapsed to never and getRecommendedValidatedModel() acquired the literal return type undefined, making the exported helper uninhabitable for any future caller.
3. The docs claim was false. docs/model-validation.md asserted the curated registry "points new setups at" DeepSeek and then contradicted itself two lines later.

DeepSeek V4 Flash 0731 remains in the registry as a candidate with the verified 400K context. The curated recommendation returns to moonshotai/kimi-k2.6, the only entry with a MiMoCode workflow proof record in src/constants/model-validation.ts.

This does not weaken the user-facing outcome. The public picker is built from the live GET /v1/models response, where src/install/model-catalog.ts:95 flags the first returned model as recommended — and DeepSeek is already first in the live catalog. So a fresh npx @gonkagate/mimo-code-setup run already defaults to DeepSeek V4 Flash today.

Blocked follow-up: promoting DeepSeek inside the curated registry requires a real MiMoCode validation run recorded in src/constants/model-validation.ts. That is maintainer work needing a live GonkaGate key and a MiMoCode install; fabricating the record would violate this repository's own AGENTS.md.

Local proof after the fix: npm run ci exit 0 — typecheck, build, 82/82 node:test, prettier, publint, and package smoke all pass.

[Dankosik]

Direction change: the hardcoding approach in this PR has been replaced with live model metadata.

What this PR used to do: add deepseek-ai/deepseek-v4-flash-0731 as a fifth checked-in entry in CURATED_MODEL_REGISTRY, with a hand-written 400_000 context window, plus docs and contract-test updates naming it.

Why that was wrong: it made the repository a second source of truth for a catalog GonkaGate already owns. The registry it extended was already drifting - it pinned 262_000 for Kimi and 205_000 for MiniMax against a live catalog of 240K and 180K - and each new model would have needed another commit here. The repo's own PRD already said the installer "must not hardcode the public setup model list", so the hardcoded registry was working against a stated invariant.

What replaced it: the curated registry is deleted. Model ids, display names, descriptions, context windows, and the --yes default (data[0], positional) are read from GET /v1/models. Adding a model to GonkaGate now needs no change in this repo at all, so the original goal is met without naming any model in code.

Compatibility, since the gateway change is not deployed yet: the fallback path was written first. Only id is required; name, description, and context_length may be absent, null, wrong-typed, or blank. Missing name falls back to the model id (unchanged from today), missing description is omitted, and missing context_length writes no limit block instead of the context: 0 this repo writes today. Both response shapes are covered by tests.

Not faked: no validation record was invented. src/constants/model-validation.ts still holds only the real moonshotai/kimi-k2.6 MiMoCode workflow proof, and the contract test now checks that ledger for internal consistency instead of tying it to a checked-in registry.

npm run ci is green: typecheck, 89 tests, format check, build, publint, and package smoke.