fix(providers): resolve the Codex auto-ping model from the live catalog instead of a retired id

[pacocartones]

Summary

• The opt-in Codex quota auto-ping pinned gpt-5.1-codex-mini as its ping model. OpenAI shut that model down on 2026-07-23 and the repo's own lifecycle registry already rejects it on the request path, but the scheduler never consulted that gate, so every window slide sent a dead id, hit the 15-minute failure cooldown, and retried the same id forever.
• The ping model is now resolved per tick from the provider catalog and the lifecycle registry (first base-model entry that isModelSelectable("codex", id) allows, the same gate chatCore uses). The registry import stays lazy because this module is on the instrumentation boot path (fix(backend): dev bundlers exhaust memory on oversized shared import graphs #12074).
• When nothing in the catalog is selectable, the provider is paused before any throttle slot, usage read, or executor call, with one warning per state change instead of a blind retry loop.

Related Issues

• Closes fix(providers): stop using retired gpt-5.1-codex-mini for quota auto-ping #11905
• Related to feat(providers): auto-ping for quota window management — Antigravity follow-up #6977, feat(quota): opt-in auto-ping to keep Codex quota windows warm (#6977) #6995, [v3.8.50] fix: enforce OpenAI model lifecycle without silent reroutes #8627, fix(providers): route quota auto-ping polling through the shared cache and throttle #11904

Validation

• Change type: provider
• Focused tests and category gates from the golden path: tests/unit/quota-auto-ping.test.ts 22/22; instrumentation-import-graph-12074 + hard-session-lease-bypass-inventory 9/9; npm run typecheck:core 0; git diff --check clean; npm run check:changelog-integrity OK
• npm run lint — repository-wide eslint exit 0 (run with --pass-on-unpruned-suppressions; the literal command reports only pre-existing unused global suppressions on this base)
• Reconciled with the current active release base release/v3.8.51@158647618; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube is temporarily opt-in while the private project has no quota; it is not a PR gate.

TDD: the three new tests fail on the base (resolver missing; the no-model case still emits throttle, fetch, throttle, fetch) and pass with the fix; reverting only the production hunks makes exactly those three fail again.

Tests Added Or Updated

• tests/unit/quota-auto-ping.test.ts: three new tests: the resolver returns a catalog model that the lifecycle gate accepts and that is not the retired id; the tick sends the runtime-resolved model (not a hardcoded one); an empty or retired catalog pauses the provider with no throttle slot, usage read, executor call, or DB write on the first and later ticks.

Coverage Notes

• src/lib/services/quotaAutoPing.ts and src/shared/constants/quotaAutoPing.ts are covered by tests/unit/quota-auto-ping.test.ts (all 19 existing tests still pass; the new resolver, the pause path, and the change-only logging state are exercised directly).
• typecheck:core does not include this service; a scratch type-check of the two production files shows only errors that already exist on the base (getProviderConnections assignment here and two in credentialRefresh.ts).

Reviewer Notes

• Resolution order is registry order (currently gpt-5.6-sol), matching getDefaultModel; effort-suffixed variants are skipped because the ping already sends reasoning.effort: "none". No new model literal is introduced, per the issue and the maintainer's comment. If a lighter model such as gpt-5.6-terra is preferred, that is a one-line ordering rule.
• QuotaAutoPingDeps gains a required resolvePingModel and QuotaAutoPingState gains pingModelCache; the only real constructor is createDefaultQuotaAutoPingDeps().
• Open PR feat(perf): lazy-boot quota auto-ping scheduler + build heap floor guard #12333 (lazy-boot scheduler) touches the same service and test file; expect a small textual conflict whichever lands second.
• Not changed here: open-sse/services/backgroundTaskDetector.ts still maps gpt-5.1-codex to gpt-5.1-codex-mini, and codexToolOptions.ts still lists retired ids; separate concerns.
• No live ping was sent; validation is test-first only.