feat: refresh Franklin models through shared Model Core

[KillerQueen-Z]

Franklin's model picker and price estimates drifted when gateway models changed. This integration consumes the public BlockRun Model Core, with its runtime pinned to 2b55804b109cd132bd988096fb3617fb48e67cfb. It refreshes shared policy and the active gateway's live model catalog without requiring a Franklin release for ordinary model-list and pricing updates.

Final merged behavior:

• Existing Franklin aliases, including free aliases, keep their model targets. Shared policy may add shortcuts but cannot retarget an alias Franklin already ships. Price estimates for the same model still refresh from the gateway.
• The default picker shows Auto and curated groups; remaining available chat models are accessible through +more / Ctrl+A.
• Policy and gateway requests run concurrently. A policy-host failure retains the last good policy while still applying live gateway rows. A gateway failure retains the last valid catalog. Bundled startup data is not reported as live gateway evidence.
• CLI startup warms the catalog in the background. Base, Solana and API-account caches remain isolated; API credentials are sent only to the active gateway.
• Payment signing/settlement and Auto routing's candidate policy are unchanged. Historical prices and explicit compatibility pins are retained.

The review's blocking policy-outage regression was fixed in Model Core #1 and incorporated before merge. This description reflects the final merged implementation, not the initial revision. The remaining README wording is corrected in Franklin #183.

Validation:

• Final PR head 4dad775dfbc822ee8174c00d3207c1eb947afc69: Node 20/22 CI, macOS/Windows desktop builds, and Brand numbers all passed.
• Reverification on 2026-09-30: Franklin v3.47.0 source npm test passed 766 tests; pinned Model Core npm run check passed 21 tests, with zero failures/skips.
• Policy-host failures injected against real Base and Solana model-list endpoints: cold-start and warm-cache cases both retained live gateway rows; gateway requests were not skipped.
• No paid inference or settlement end-to-end calls were performed.

[VickyXAI]

Thanks for this — the direction is right and the suite is green locally (765/765). Holding the merge on one regression plus a few product calls.

Blocking — a failed snapshot fetch skips the gateway fetch. In @blockrun/model-catalog refresh(), the catalogUrl fetch runs first inside the same try; if it throws, the gateway /v1/models fetch never runs and the client falls back to the bundled snapshot. Reproduced against this branch:

• default: source: live, 106 models
• BLOCKRUN_MODEL_CATALOG_URL unreachable: source: bundled, lastError: "fetch failed", gateway never contacted

So a GitHub outage, or any network where raw.githubusercontent.com is blocked (mainland China, some corporate proxies), pins users to stale models and prices — worse than main, which only needs the gateway. A policy-fetch failure should keep the last good policy and still refresh gateway rows. Fixing this in model-catalog; will re-pin here.

Product calls (owner decision before merge):

1. Rolling shortcuts (opus, sonnet, grok, …) are now driven at runtime from model-catalog main. A push there retargets every installed Franklin within ~5 min, including price, with no release.
2. Existing aliases move in this PR: claude Opus 5 → Sonnet 5.5, sonnet → Sonnet 5.5, grok → Grok 4.7.
3. The picker goes from the curated ~24 rows to every available chat model (82); the trim tests are deleted.
4. Only aliases targeting FREE_DEFAULT_MODEL are locked free; other legacy free aliases (laguna, ultra-550b) can be remapped remotely.

Minor:

• The gateway models request no longer sends Franklin's User-Agent.
• start.ts now awaits up to two sequential 4 s requests before startup continues.
• The README section lands below the closing footer </div>.