fix(auxiliary): preserve custom provider headers

[tcconnally]

Summary

• Preserve providers.<name>.extra_headers when Hermes constructs auxiliary OpenAI-compatible clients.
• Ensures named custom providers retain Cloudflare Access service-auth headers for automatic auxiliary tasks such as compression.
• Keeps the existing secure pair-header design and does not change provider selection or Ollama binding.

Verification

• Upstream-main auxiliary/provider tests: 55 passed.
• Canonical per-file runner: 35/35 passed.
• Ruff: clean.
• Live temporary-config acceptance through Cloudflare Access → Pop!_OS → Ollama: UPSTREAM_BASE_AUX_LIVE_OK.

Deployment note

After this upstream fix is included in the managed Hermes image, the existing llama provider can be assigned to auxiliary compression and verified end to end.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #61346. Both repair named custom-provider extra_headers on auxiliary clients; #61346 is the broader open patch, covering async reconstruction, fallback paths, precedence, and regression coverage.

[tcconnally]

Closing this as a duplicate of #61346, per the triage note. #61346 is the broader open patch covering named custom-provider extra_headers on auxiliary clients (including async reconstruction). Happy to fold any missing coverage into #61346 if helpful.