fix(providers): lock opencode model on upstream 400 model-unavailable

[maxmad64bis]

⚠️ base-red inherited: #12732

Summary

When the opencode upstream reports a model as down (400 "Model is unavailable"), that model stays served: every later request burns a full round-trip to get the same 400 back. Observed case: a free-tier model failed every call for days while remaining selectable.

This PR adds a catalog rule for the opencode family that locks the MODEL (not the connection) with a declared 1h cooldown, self-healing through the operator-controlled clamp (~30min default, escalating in-window). Malformed 400s keep the existing zero-cooldown guard (#2101) — no lock, no escalation.

Two allowlist-adjacent changes, both headlined for review: HONORS_RULE_LOCK_SCOPE_PROVIDERS gains the opencode family so the persistence layer honors the rule's model scope (per #10334), and markAccountUnavailable gains a narrow ruleScope === "model" branch gated on status === 400 (every other status keeps its path — the agentrouter 403 forbidden flow is untouched). FULL_TEXT_RULE_PROVIDERS is deliberately NOT widened: that would short-circuit the #10880 egress-bucketed block, so quota-body 429s keep their current classification. The lockout cooldown is read from the rule itself, not a literal at the call site.

Related Issues

Related to #12777 (upstream 400s scored as account failures — answered here for one narrow, proven-dead case: a multi-day upstream outage is not a shape error, and a self-healing cooldown is not a terminal verdict). Same effect is already available without code via settings.providerErrorRules; this PR is only the catalog default. Catalog eviction is out of scope.

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Ten focused suites, 121/121 pass on the release base (suites named in Tests below). Probe: quota-body 429s stay rate_limit_exceeded with no scope, the pinned 400 returns model_capacity/model. typecheck:core clean; eslint clean on touched files (full-repo lint:json OOMs locally — CI-owned; wider-sweep red is pre-existing, see Reviewer Notes).

Tests Added Or Updated

New tests/unit/opencode-400-model-unavailable.test.ts (verbatim locks, malformed-400 guard, isModelLocked round-trip, 429 headers rule pinned for all four family members, monthly-quota 13-day cooldown with no scope, quota-body markers inert, verbatim terminal off-family, combo classifier regression). agentrouter-error-rules.test.ts: A14 only (HONORS family).

Coverage Notes

The new markAccountUnavailable branch is covered by the isModelLocked round-trip; the status === 400 narrowing is covered by the agentrouter 403 suite (it caught the hijack as a real RED during development).

Reviewer Notes

Three deliberate points. The HONORS widening lets the headers-only quota rule surface its declared connection scope on header-passing paths — the #10880 egress block stays reachable (FULL_TEXT untouched, proven by the marker loop). Branch-ordering note: that branch now runs before the egress block, so an opencode 429 with upstream quota headers takes the connection cooldown and skips sibling cooling — latent today (only chat-completions forwards headers, and the observed opencode 429 envelope is headers-less). The new branch uses a model && provider && guard, no non-null assertion. Wider-sweep red is pre-existing (identical on the unmodified base), so those boxes stay unchecked.