fix(model): isolate custom provider picker credentials (salvage #34757)

[teknium1]

Summary

The /model picker no longer merges distinct custom_providers that share a base_url but differ in key_env or api_mode, so selecting a model can no longer route through the wrong credentials and wire protocol.

Root cause: the picker grouped custom providers by (base_url, api_key). When entries use key_env instead of an inline api_key, the api_key field is empty for all of them, producing an identical group key — distinct providers collapsed into one row, and selection routed through the first provider's key + api_mode.

Changes

• hermes_cli/model_switch.py: group custom providers by (base_url, credential_identity, api_mode) where credential_identity is env:<KEY_ENV> (no secret values exposed); tighten the is_current highlight so a shared base_url only marks a bare-custom row current when exactly one group lives at that URL.
• scripts/release.py: add zapabob author-email mapping.
• Tests: same-host different-key_env/api_mode stay separate (picker + runtime resolution).

Validation

	Before	After
Two same-host providers (GPT codex_responses + Claude anthropic_messages)	one custom:gpt row with both models; Claude routes through GPT key	separate custom:gpt / custom:claude rows, isolated models, correct credentials
4 same-host Ollama entries (no key_env/api_mode)	one row	one row (unchanged)
Single current custom (slug or bare-custom, GH#17478)	highlighted	highlighted (unchanged)

Targeted tests: 181 passing across test_model_switch_custom_providers, test_runtime_provider_resolution, test_user_providers_model_switch, gateway model/discord/telegram pickers. Bug reproduced on main and verified fixed E2E.

Salvages #34757 by @zapabob onto current main (cherry-picked, authorship preserved). Fixes #34725.

Infographic