feat: add custom model names and option descriptors

[rynfar]

A custom model could only be a bare slug, so it appeared in the picker under its raw slug
and borrowed whatever option descriptors its driver defaulted to. An entry can now carry a
display name and its own capabilities; a bare slug keeps working exactly as before.

This is a prerequisite for the Antigravity port — Antigravity's settings schema references
CustomModelSetting, which this introduces.

Adopted from T3 Code

• 5a433244d0b827176df8b76a05959cd1a7a98ce2 (#9807) add custom model names and option descriptors

Pylon adaptations

Upstream authored this after its Antigravity provider landed, so its diff carries context
that does not belong here:

• Antigravity guards dropped. driverKind === "antigravity" short-circuits in
  modelSelection.ts and ProviderInstanceCard.tsx are left out. They come back with the
  Antigravity port; adding them now would reference a provider Pylon does not have.
• Pylon's Codex probe kept. Upstream's diff carries a copy of probeCodexAppServerProvider
  that predates Pylon's refactor in fix(codex): keep subscription capacity through a missed usage read #417 and would have duplicated the existing function. Pylon's
  is kept, with only the CustomModelSetting typing applied.
• Prime updated, which upstream never had to do. Widening customModels broke
  primeAgentModelsFromSettings in four places, because Prime is Pylon-only. The shared
  providerModelsFromSettings already accepts the wider type and honours entry names and
  capabilities, so widening Prime's wrapper both fixes the break and gives Prime custom model
  names and per-model option descriptors.

Upstream's rename of the redacted-email test is taken as-is.

Verification

• 167 tests across 9 files: 136 for the ported behaviour, plus Prime provider/driver (31)
  and provider snapshot coverage because this changes Prime.
• @t3tools/contracts, @t3tools/shared, @t3tools/web and t3 typecheck clean.
• Lint and format clean across all 20 changed files.

Worth noting: the Prime break did not fail any test — only typecheck caught it. Anything
reviewing this on test results alone would have missed it.

No contract-breaking change (CustomModelSetting is a union that still accepts a bare string),
no dependency change, no migration.

Model and harness: Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.8 KiB	13.6 KiB	−162 B (−1.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.5 KiB	−162 B (−2.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.4 KiB	56.5 KiB	−910 B (−1.5%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.7 KiB	−156 B (−1.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−2 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.6 KiB	−154 B (−2.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.2 KiB	57.3 KiB	−928 B (−1.6%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: dbeb9c1 · PR result: 6260fe0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.