test(catalog): make live native integration test reliable on Windows

[pavelhov]

What changed

Promote the qualified development head to stable main for CodexCommander 0.1.19:

• fix(opencode-go): preserve sessions across all Go model wires #76 keeps OpenCode Go sessions stable across Chat Completions, Anthropic Messages, and OpenAI Responses. Codex subagents and Claude Code turns retain their own opaque session lanes. It also adds DeepSeek V4.1 Flash, GLM-5.3 Flash, and Qwen3.8 Flash to the trusted Go catalog.
• test(catalog): make live native integration test reliable on Windows #77 makes the live native model integration test reliable on Windows.
• chore(release): prepare 0.1.19 #78 bumps the package version to 0.1.19 for a distinct immutable macOS release archive.
• test: reuse verified identity in transition race probes #80 stabilizes the Windows transition race test by reusing one verified test identity under full-suite load; runtime identity handling is unchanged.

Why

OpenCode Go requires a stable session identifier. Missing or changing identifiers caused upstream MissingSessionID errors and lost conversation affinity. This promotion carries the reviewed fix and the version needed for the next preview release.

Verification

• fix(opencode-go): preserve sessions across all Go model wires #76 was independently reviewed, approved, and passed aggregate CI.
• chore(release): prepare 0.1.19 #78 passed aggregate CI. test: reuse verified identity in transition race probes #80 passed aggregate CI.
• Locally, the amended Go change passed 56 focused tests, typecheck, privacy scan, docs build, and bun run test:parallel (all 630 files). The versioned tree passed bun run test:macos (85 Swift UI tests), typecheck, and privacy scan. The test: reuse verified identity in transition race probes #80 test-only tree passed typecheck, the focused transition test (4 tests), and bun run test:parallel (all 630 files). An isolated real installed-app Sparkle update passed with a disposable key and bundle.
• This promotion PR's ci check must pass before merge. The development macOS/Windows workflow on commit cefcd745a and this PR's refreshed ci checks must pass before merge. The automatic workflow will run again after the push to main and must pass before publication.

Security and distribution review

The Go session header is a scoped digest of a task ID or Claude per-session metadata, never the raw value. It is added only for the canonical fixed-key OpenCode Go destination; configured provider headers retain precedence. Authentication, credential storage, request logging, dependencies, workflows, and release scripts are unchanged.

The external Sparkle public/private key files and pinned 2.9.6 tool directory are present; the private file remains a physical single-link mode-0600 file outside the release assets. The previously published signed feed and every referenced archive verify against the configured public key. The 0.1.19 archive will be built from the clean merged main commit with a new build number and verified, together with the signed feed and downloaded draft assets, before release publication. No key contents will be logged or committed.