Test: AST drift gate for derive-provider.sh ↔ Go port

[HongmingWang-Rabbit]

Summary

PR #2535 introduced a Go port of workspace-configs-templates/hermes/scripts/derive-provider.sh (deriveProviderFromModelSlug in workspace-server/internal/handlers/workspace_provision.go) so the platform can persist LLM_PROVIDER to workspace_secrets at provision time and survive Save+Restart. Independent code review flagged that the port created two sources of truth — if a future PR adds a provider prefix to one without the other, the platform's persisted LLM_PROVIDER silently disagrees with what the container's derive-provider.sh produces at boot. The container always wins (it writes ~/.hermes/config.yaml), so the platform's value becomes stale and misleading without any test going red.

This PR adds a hermetic drift gate (one new test file, no production-code changes) that pins the invariant: the prefix set the two functions know about must be identical, modulo a hardcoded acceptedDivergences map for the two documented runtime-only differences (nousresearch/* and openai/* both fall back to openrouter at provision time because derive-provider.sh's HERMES_API_KEY / OPENAI_API_KEY checks aren't available until container boot).

Approach

Behavior-based AST gate, same pattern as PR #2367 (TeamHandler.Expand drift) — pin the invariant by what the function maps, not by what it's named:

1. Shell side — parse derive-provider.sh with regex (handles both single-line pat/*) PROVIDER="x" ;; clauses and multi-line conditional clauses; first PROVIDER= literal wins for the conditionals); skip the *) catch-all because its auto value has no Go counterpart by design.
2. Go side — parse workspace_provision.go with go/ast, locate deriveProviderFromModelSlug by name, walk the *ast.SwitchStmt, extract every *ast.CaseClause's string-literal labels paired with the case body's first return STRING_LITERAL.
3. Cross-check both directions + verify every entry in acceptedDivergences still appears in both maps (a stale entry silently weakens the gate).
4. Failure messages name both files + the exact fix path: either align the Go function with the shell, OR add the prefix to acceptedDivergences{} with a comment.

A companion TestDeriveProviderDrift_ShellParserIsSane pins anchor prefixes (anthropic, minimax-cn, the openai/nousresearch multi-line clauses, the dashscope/qwen alias group) so a future shell-syntax change can't silently produce an empty map and trivially pass the main gate.

Constraints respected

• Stdlib-only — go/ast, go/parser, go/token, regexp. No new dependencies.
• Hermetic — reads two monorepo files in-process. No network, no docker, no DB.
• One new file. Production code (workspace_provision.go, derive-provider.sh) untouched.
• Reads the monorepo copy of derive-provider.sh, not the standalone mirror at molecule-ai-workspace-template-hermes — the monorepo copy ships in the same git SHA as the Go code; mirror drift is task fix(scheduler): recover from panics + add liveness watchdog (#85) #90's concern.

Closes task #242. Companion to PR #2535's table-driven mapping test in workspace_provision_shared_test.go (which pins the values; this gate pins the coverage of the prefix set itself).

Test plan

• go test ./workspace-server/internal/handlers/... -run "DeriveProviderDrift" -v — passes (29 prefixes extracted from each side, drift directions both green)
• go vet ./workspace-server/... — clean
• go build ./... — clean
• CI green on staging base

🤖 Generated with Claude Code

[github-actions]

🔒 Auto-merge disabled — new commit (dfeefb0) pushed after auto-merge was enabled. The merge queue locks SHAs at entry, so subsequent pushes can race. Verify the new commit and re-enable with gh pr merge --auto.