fix(release): clear 12 base-reds of release/v3.8.51 (opencode retry, tool-map side channel, audio id, CI cache key, stale contracts)

[diegosouzapw]

Clears the 12 unit reds of release PR #11442 (shards 5/8 and 6/8, CI run of 2026-09-29). Every red reproduced deterministically on the origin/release/v3.8.51 tip (9bbf6ef) before the fix.

Red	Cause (culprit)	Fix	Proof
every postinstall helper imported by postinstall.mjs is in the cache key	#12961 made postinstall.mjs import betterSqlitePrebuildTarget.mjs; the npm-ci-retry cache key did not hash it (a stale node_modules could survive a helper change)	add the file to the hashFiles key in .github/actions/npm-ci-retry/action.yml	red → green
DefaultExecutor.execute does not produce duplicate anthropic-version header…	#14627 intentionally bumped the Claude Code client to 2.1.280; the test hard-coded 2.1.258	assert against CLAUDE_CODE_CLIENT_BILLING_VERSION (the exact value stays pinned in claude-codex-identity-version-sync.test.ts)	red → green
tools declared by the client are never removed, even for a title prompt	#14156 intentionally appends the required placeholder names after client tools	assert the client's tool goes out first and intact (no longer "verbatim list")	red → green
OpencodeExecutor free-tier refusal retry… / retries once with observed names appended…	#14156 × #14464: the first dispatch now already carries the resolved names, so the observed-tools retry could re-send the exact body the upstream just refused	production: opencodeFreeTierRetry.ts skips the retry when the merged body adds no name beyond the first dispatch; test aligned to #14156 (configures bash so the retry adds something) + new regression test	new test red without the fix, green with it
Qwen Cloud Token Plan remains a flat-rate provider with chat models only	#14273 intentionally registered qwen3.8-flash and deepseek-v4.1-flash	expected list updated	red → green
gemini: / antigravity: both namespace identities and sanitizer aliases survive chatCore extraction	#14751 made extractRequestToolIdentityMap keep _toolNameMap next to namespace identities; #12839's extractRequestToolMetadata (the chatCore entry point) must consume both side channels	production: extractRequestToolMetadata deletes _toolNameMap after capturing the alias ledger it returns (the standalone extractor keeps #14751's behavior)	red → green; #14751's gemini-responses-custom-roundtrip + tool-name suites green
handleAudioTranscription rejects invalid HuggingFace model paths	#15067 made the registry parser refuse unsafe ids, which surfaced as "No transcription provider found"	production: handler answers 400 Invalid model ID up front for hasUnsafeModelIdSyntax ids	red → green; model-id-path-injection green
chatCore retains exact quota resets from intermediate rotated Codex 429s	#14959 (bisected) skips same-account intra-retries for a Retry-After: 60 hint; the test's calls.length < 4 counted those retries	429 keyed on the first account's token instead of a call count	red → green
Fix A: getAccessToken invokes onPersist INSIDE the per-connection mutex closure / serialized refresh re-checks rotation inside the lane…	#15002 intentionally moved the closure into const work = (async…)() raced by entry.promise, and added a log arg (prettier wraps the call)	regexes accept the new shape (and assert entry.promise races work); whitespace-tolerant serializeRefresh(	red → green

Gates: typecheck:core clean, check:open-sse-typecheck OK, ESLint clean on changed files, check-file-size OK (measured after commit).

Not touched (outside this list): opencode-geo-block-rotation (3) and opencode-transient-retry-delay (1) fail on the pure tip locally too but not in CI (environment); issue-11912 passes in isolation.