Keep legacy persisted provider aliases on the selected route across connect/disconnect #203

Summary

Persisted Codex threads retain their original model_provider ID. Sessions created while another router owned Codex may therefore require a compatibility provider such as cc-switch-official to remain defined.

A compatibility section prevents Model provider ... not found, but CodexHub currently manages only [model_providers.custom]. This can split routing across overlay transitions:

• Before Connect, both custom and the compatibility alias may be Direct Official.
• Connect rewrites only custom to the local Gateway; legacy sessions using the alias continue bypassing CodexHub.
• If the alias is manually mirrored to the Gateway, Disconnect restores the pre-connect backup and returns the alias to Direct Official.
• A later Connect again updates only custom, so the manual alias migration is not durable.

This was observed with 121 persisted sessions using cc-switch-official.

Desired behavior

Provide an explicit, fail-closed compatibility-alias contract for persisted provider IDs rather than silently rewriting session history.

While connected:

• configured legacy aliases mirror the managed Gateway route, including local base URL, auth, wire API, and websocket settings;
• key rotation and port changes update every managed alias atomically.

While disconnected:

• those aliases resolve to Direct Official when that is the configured fallback;
• custom may remain the unified history bucket, but transport is Direct Official.

Unknown user-owned provider sections must remain untouched.

Why not rewrite session metadata immediately

Changing a persisted provider ID from cc-switch-official to custom changes JSONL byte lengths. CodexHub's current history overlay deliberately requires byte-length-preserving rewrites, and Codex paginated history can persist byte offsets and ordinals. A routing alias is the safer immediate compatibility mechanism until provider migration has an offset-safe, projection-aware design.

Acceptance criteria

• A configured compatibility alias follows Gateway Connect, Disconnect, reconnect, port changes, and Gateway key rotation.
• Legacy sessions cold-resume on every transition without provider not found.
• Connected legacy sessions are observable in Gateway telemetry rather than bypassing the Gateway.
• Direct mode removes the local base_url and Gateway bearer from managed aliases.
• Unknown provider sections are never claimed or rewritten.
• Backup/restore and interrupted writes remain atomic and reversible.
• Tests cover a full Direct → Gateway → Direct → Gateway lifecycle with both custom and a legacy alias.

Relationships

• Related to Preserve V2 agent topology and paginated history during consolidation #197 for persisted V2/history safety.
• Related but not duplicate to Preserve Codex agents configuration across Gateway overlay lifecycle #199, which covers preserving [agents] configuration across the overlay lifecycle.
• Independent of Codex 0.145 rejects generated catalog: upgrade is emitted as a string #202, which covers Codex 0.145 model-catalog upgrade metadata.