fix: prevent stale base_url after provider switch

[timrichardson]

Fixes #47521

Summary

• Prevents a stale model.base_url from a previous built-in provider from hijacking a newly selected built-in provider runtime.
• Covers the reported ollama-cloud + deepseek-v4-pro case where model.base_url remained https://chatgpt.com/backend-api/codex after switching away from Codex.
• Persists the resolved endpoint (or clears it) when CLI global model switches save model.default / model.provider, so stale endpoints are not left behind for the next process.
• Retains current main's existing gateway behavior, which already clears non-custom endpoints.

Reproduction on current main

Without the fix, runtime resolution accepts the stale Codex URL solely because the persisted provider now matches Ollama Cloud. The regression exercises both the normal API-key path and a real credential-pool selection path.

Implementation notes

• Adds _provider_supports_config_base_url_override() to reject config base URLs that point at another known provider's stock endpoint.
• Keeps existing provider-specific proxy behavior intact, including MiniMax CN and TokenHub overrides.
• Applies the guard in both the credential-pool layering path and the normal API-key provider runtime path.
• Updates both CLI global-switch persistence paths on current main.
• Drops the stale gateway delta identified in review.

Tests

scripts/run_tests.sh \
  tests/hermes_cli/test_runtime_provider_resolution.py \
  tests/hermes_cli/test_model_switch_persistence.py \
  tests/hermes_cli/test_apply_model_switch_result_context.py \
  tests/gateway/test_model_switch_persistence.py -q

# 169 passed

[teknium1]

Thanks for tracing the stale-endpoint path. The runtime premise remains valid on current main: hermes_cli/runtime_provider.py:2028-2032 still accepts model.base_url solely because model.provider matches, and the credential-pool counterpart at hermes_cli/runtime_provider.py:480-491 does the same.

Problems

• The gateway hunk is stale. Current gateway/slash_commands.py:1671-1674 already clears non-custom base_url through clear_model_endpoint_credentials(..., clear_base_url=True), added in f6deabca0d8010d485d4d3a8744d0ceb797eacb9.
• The supplied Ollama regression uses a pool with has_credentials() == False, so it does not cover the changed credential-pool branch.

Suggested changes

• Port the runtime guard to both current resolution branches and retain the existing gateway clear behavior.
• Add a pooled Ollama Cloud stale-Codex URL regression plus a CLI global-switch persistence test.

Automated hermes-sweeper review.

[timrichardson]

Updated against current main per the sweeper review: retained the existing gateway clear behavior, ported the runtime guard to both resolution branches, added a credential-pool Ollama Cloud regression, and added real CLI config-persistence coverage. Targeted suite: 169 passed via scripts/run_tests.sh.