fix(pixel-settings): reject active token limits exceeding provider capacity

[vaibhavsrv]

Why this matters

In ods/bin/pixel_settings/contract.py, _capabilities(value) validates runtime capability evidence reported by providers and host environments before computing preferences or accepting settings readbacks. While providerMaxOutputTokens > providerContextTokens and activeMaxOutputTokens > activeContextTokens are explicitly rejected, the contract omitted checks bounding active token limits against provider capacity: activeContextTokens > providerContextTokens and activeMaxOutputTokens > providerMaxOutputTokens.

When inconsistent capability documents are received where active context or active output tokens exceed provider capacities (such as corrupted state or misconfigured models), _capabilities() silently accepts the dictionary as valid. Later callers invoking preview_preferences() with empty change sets then fail with deferred preference-validation errors (context-exceeds-declared-or-observed-capacity or output-exceeds-capacity) rather than immediately diagnosing the malformed runtime capability evidence with invalid-runtime-capabilities.

This surgical fix adds upper-bound constraints ensuring that active token limits do not exceed provider capacities during runtime capability validation.

Validation

• Baseline reproduction: Tested contract.preview_preferences({}, caps(activeContextTokens=200000)) and contract.preview_preferences({}, caps(activeMaxOutputTokens=20000)) on unpatched contract.py; baseline failed capability evidence validation assertions by yielding deferred preview rejection instead of invalid-runtime-capabilities.
• Post-fix behavior: Both cases immediately raise SettingsError("invalid-runtime-capabilities") during _capabilities verification; all 46 contract unit tests pass cleanly.
• Telemetry: pixel-settings suites: 46 passed. New-test syntax and diff checks pass; new regressions wired into test suite.

Overlap check

• fix(dashboard-api): tolerate evicted or missing attempts during pixel chat cancel #5695 (fix(dashboard-api): tolerate evicted or missing attempts during pixel chat cancel): Touches dashboard API chat result store lifecycle; zero overlap with settings contract validation.
• fix(pixel-gateway): answer 401 for non-ASCII Authorization headers #5693 (fix(pixel-gateway): answer 401 for non-ASCII Authorization headers): Restricts header bytes validation in provider gateway; zero overlap with settings capability contracts.
• fix(pixel-edge): reject query parameters on chat completions route #5691 (fix(pixel-edge): reject query parameters on chat completions route): Enforces edge route query strictness; no overlap with token capability boundaries.
• fix(pixel-settings): reject active context exceeding provider limit in capabilities #5616 (fix(pixel-settings): validate runtime capability bounds): Introduced capability schema checks; this change completes the active capacity invariant checks without modifying existing contracts or defaults.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens capability validation bounds and does not change valid runtime profiles or downstream defaults. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #5695 at b44474771 without conflicts. Production and test diffs passed together; settings and provider checks remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.