feat(combo): publish safe metadata and enforce portable context

[zierocode]

Problem

Logical fallback Combos need one portable context contract even when members have different context windows. Public metadata must stay conservative, and oversized requests should not be dispatched to a known undersized fallback member.

Closes the context-routing requirement in #1089.

Implementation

• recursively resolves nested Combo members to physical leaves
• intersects boolean capabilities and takes the minimum verified token limits
• omits aggregate metadata for cycles, missing leaves, or unknown values
• keeps members and representative physical models out of the public response
• canonicalizes public model ordering for stable response bytes
• returns a strong ETag over public state plus an HMAC-backed private-membership revision
• honors exact, list, weak, and wildcard If-None-Match validators with an empty 304
• estimates input + requested output + buffer before Combo dispatch
• preserves route order while skipping members whose known context window is too small
• returns typed combo_context_window_exceeded without provider dispatch when every known member is undersized

The runtime check is defense in depth, not exact tokenizer proof. Clients should size and compact against the logical Combo's advertised minimum context window.

Upstream relationship

• feat(capabilities): model capability metadata on /v1/models, combo aggregation, pattern fixes #2242 remains the owner of broad physical-model capability discovery; this PR replaces optimistic Combo aggregation with a conservative projection around that registry.
• fix(capabilities): correct thinking format and limits for the 4.6+ Claude generation #2760 owns current Claude Opus 5 / Claude 4.6+ catalog limits; this PR consumes those capabilities and does not duplicate that model catalog work.
• unrelated OpenAI/Codex proposal documents were removed from this branch to keep review scope focused.

Verification

• Combo metadata, context preflight, routing, and fusion: 4 files, 32 tests passed
• production build: npm run build passed
• RED proof: the 5 new context tests failed before implementation and pass after it

Base: 79918c7830695bbca4a45c9fea4a42c3e9fd73d1 (v0.5.40)
Head: 80181614