feat(model_switch): honor discover_models in custom_providers section 4 (salvage #29810)

[kshitijk4poor]

Summary

Salvages the still-relevant part of #29810 (which is 1,568 commits behind main and no longer applies). That PR bundled two changes:

1. key_env resolution in section 4 — already landed independently in aa283d1e4 (custom-provider picker credential isolation), which replaced the old 2-tuple group key with (api_url, credential_identity, api_mode) and added the key_env fallback. Not carried here (redundant).
2. discover_models in section 4 — still missing on main. This PR.

What this does

Section 3 (user providers:) already honors discover_models: false to skip live /models discovery and keep the explicit models: list. Section 4 (custom_providers: list) did not — should_probe ignored the field, so any grouped custom provider with an api_key always had its configured subset replaced by the full live /models catalog.

This adds the same discover_models support to section 4:

• Default True — no behaviour change for existing configs.
• discover_models: false keeps the explicit models: list even when an api_key is present.
• String values ("false"/"no"/"0") are normalised to False, matching section 3.
• If any entry in a grouped endpoint opts out, the whole grouped row opts out.

Use case

Endpoints that expose a full aggregator catalog via /models but only serve a configured subset:

custom_providers:
  - name: my-endpoint
    base_url: https://internal.example.com/v1
    api_key_env: MY_API_KEY
    discover_models: false
    models:
      DeepSeek-V4-Flash:
        context_length: 200000
        name: DeepSeek-V4-Flash
    model: DeepSeek-V4-Flash

Tests

Added two regression tests in tests/hermes_cli/test_model_switch_custom_providers.py:

• discover_models: false + api_key preserves the explicit subset and never calls fetch_api_models.
• String "false" is normalised to disable discovery.

Both pass. Three pre-existing failures in that file (test_..._groups_same_endpoint, test_..._distinct_endpoints_stay_separate, test_..._total_models_reflects_grouped_count) fail identically on bare origin/main — they probe a live local Ollama server because they don't mock fetch_api_models; unrelated to this change.

Credit to @ohMyJason (original author of #29810).

Closes #29810