test: pin the client provider mirrors against their server originals (#5673)

[atomantic]

Summary

client/src/utils/providers.js hand-mirrors three server modules
(providerModels.js, localModelHeuristics.js, providerGateways.js) plus the
vendored toolkit's TOOL_USE_RE, and every one of those mirrors was pinned by a
prose "keep in lockstep" comment. Each side carried its own hardcoded
expectations, so a row added to one copy alone left both suites green — the same
hole stageRunner.mirror.test.js was written to close for the context-window
table.

It isn't cosmetic in either direction: an effort level the picker offers but the
server's ladder doesn't accept gets clamped or dropped, and a tool-use family the
server recognises but the client doesn't puts a "no known tool use" warning on a
model that works fine.

Three parity suites now pin them. All read the client file as TEXT with
readFileSync and never import it, so the client's dependency tree stays out of
the server CI job — which is what makes the "deliberately NOT imported" carve-out
in providerGateways.parity.test.js unnecessary.

• server/lib/providerModels.mirror.test.js (new) — the six effort ladders,
  EFFORT_RANK, CODEX_ULTRA_MODELS, CONFIGURED_DEFAULT_SENTINELS and the
  Antigravity effort-suffix split. All ten are byte-identical today.
• server/lib/localModelHeuristics.mirror.test.js (new) — the embedding /
  vision / tool-use capability regexes. The server spells them as a commented
  array of alternatives and the client as one inline literal, so declaration TEXT
  can't be diffed: a new compareRegexDeclaration primitive compares what each
  pattern MATCHES instead. Forcing one side to adopt the other's typesetting
  would be churn for no behavioural gain. The same suite pins the toolkit's third
  TOOL_USE_RE copy, which is the array form on both sides, as text.
• server/lib/providerGateways.parity.test.js — gains the client registry as
  a third leg, scoped to the id / label / apiKeyEnv / legacyMarker fields
  the browser actually carries. It omits baseURL and legacyApiKeyField (it
  never dials the gateway and never handles the key), so toEqual against the
  server rows can't be used.

The readers fail closed: an array element that isn't a string literal, an
escape that can't be decoded by inspection ('\x2e' is ., which matches
anything), a gateway row carrying a spread or a computed value, or a recognisable
shape sitting inside a wrapped/conditional assignment all return null rather
than a partial read — a guard that reports a diverged mirror as intact is worse
than no guard.

Also refreshes the mirror pointers that had already rotted to
server/lib/stageRunner.js, a path that has not existed since the module moved
to server/services/, and points each "keep in lockstep" comment at the suite
that now enforces it.

Test plan

• cd server && npm test — 1836 files / 37310 tests green.
• cd client && npm test — 855 files / 10719 tests green; npm run lint clean.
• Mutation-checked each leg: adding an alternative to the server's TOOL_USE_RE,
  dropping max from the client's CURSOR_EFFORT_LEVELS, and renaming a client
  gateway label each fail exactly the corresponding parity test, with a message
  naming the declaration and stating which copy is authoritative.
• Fail-closed probes assert the readers return null (not a partial read) for a
  spread element, an \x/\n escape, a duplicate or computed row field, and a
  decoy array inside a wrapped assignment.

Note: services/voice/fineTuning.test.js flaked twice across full-suite runs on
this branch (grace-window timers) and passes in isolation and on a clean re-run;
it is untouched by this diff.

Closes #5673

https://claude.ai/code/session_01GMxEz43s3YCLaVZV9KmVwE