test(pixel): pin the model contract projection and plan semantics

[tang-vu]

Add ods/tests/test_pixel_model_contract.py covering bin/pixel_model_contract.py, the pure contract layer behind the Pixel model coordinator. This module decides what the generation path advertises — the bound model id, context window, output budget, reasoning flag, and the compaction reserves derived from them — so its validation and projection semantics deserve direct pinning.

Why this matters

projection() computes limits (contextTokens, maxOutputTokens, pluginContext, compaction reserves) that downstream runtime checks and the runtime session overlay consume; plan() rewrites the managed OpenClaw config for a proposed target and self-verifies via projection(). The tests pin several subtle semantics that a regression could silently change:

• Params layers resolve in order (defaults → per-model defaults → agent params); inside a layer an invalid alias falls through to the next alias (maxTokens → max_completion_tokens → max_tokens), but a declared-but-never-valid set raises invalid-model-limits.
• binding() requires exactly one pixel agent, a uniquely matching provider row, and the exact naming convention (ODS Local <id> / ODS Current (<model>)); a modelRouteFingerprint is legal only on the ods-gateway provider.
• plan() drops conflicting output-token aliases, derives toolResultMaxChars, lean bootstrap sizes and compaction reserves, and never mutates its input config.

Behavioral invariant: invalid targets/routes fail with invalid-model-contract/model-route-not-managed/invalid-model-limits before any config rewrite, and plan() output re-projects to exactly the proposed contract.

Overlap check

Searched open and closed PRs for pixel_model_contract, "model contract", and "token limits". #5606 (open) fixes float-coercion inside projection()'s limits resolver and adds test_pixel_model_contract_limits.py; it is a behavioral fix with limits-focused tests. This file deliberately does not pin float-parameter semantics (pending #5606's resolution) and covers the complementary surface: checksum/target validation, binding() route rules, layer/alias resolution order, compaction bounds, and plan() rewrites. test_pixel_model_transition.py exercises the coordinator's journal, not this module.

Production/test paths: ods/bin/pixel_model_contract.py (production callers: pixel_model_coordinator.py, host_install_lib.py), ods/tests/test_pixel_model_contract.py (new). Branched from public-beta at 4fa6ad17059a2ff7df1dd92105b87ed84b801e70.

Regression and validation

• pytest tests/test_pixel_model_contract.py: 66 passed (Python 3.12, Linux/WSL).
• Pure-module tests; no I/O, no mocks, platform-independent.
• Limitation: no live-model run — this layer computes generation budgets, it does not execute them.

Compatibility and review

Test-only; nothing to roll back. Fails loudly if route binding, alias precedence, or plan-derived budgets drift.

Implementation and relevant local checks are complete, so this PR is Ready for review immediately. Independent review remains outstanding.