fix(auto): subscription fail-closed, neutral unpriced cost, thrifty rung order (#15546)

[diegosouzapw]

Refs #15546 — complements #15813 (which fixes defect #1, RulesStrategy ignoring weights). This PR covers the plan's follow-ups; it does not close the issue.

Root cause and fixes (one commit each)

• build(deps): bump actions/github-script from 7 to 8 #2 auto/subscription fail-open: when the subscription pool was empty, expandAutoComboCandidatePool saw no candidatePool/models and widened to every active provider's full catalog (paid models included). The virtual subscription combo now carries autoConfig.failClosedWhenEmpty, and the expander returns the (empty) targets unchanged.
• deps: bump eslint from 9.39.2 to 10.0.0 in the development group #3 unpriced models near-free: combo.ts defaulted unknown models to $1/M, which min-max scoring reads as almost free next to $20-40/M frontier models. New combo/candidateCost.ts: pricing lookup retries the bare model name for namespaced ids; genuinely unpriced models take the median blended cost of the priced models in the pool (neutral), falling back to 1 only when nothing is priced. No pricing rows were added: the plan named claude-opus-5-5 / sonnet-5-5 / antigravity but I had no citable source price, so none were invented.
• fix(oauth): prevent duplicate connections on re-authentication #5 :thrifty rung order: scoring re-sorted the rung-ordered pool, so a metered model could outrank a plan-included one. Virtual thrifty combos carry autoConfig.preserveRungOrder; resolveAutoStrategy restores the incoming (rung) order after scoring via combo/rungOrder.ts. Trade-off: within a rung the pool's incoming order is kept rather than the score order (rung boundaries are not carried on resolved targets).

Tests (TDD)

• tests/unit/issue-15546-subscription-fail-closed.test.ts — RED before (21 !== 0), GREEN after.
• tests/unit/issue-15546-unpriced-neutral-cost.test.ts — RED before (module absent / old flat $1 default), GREEN (5/5).
• tests/unit/issue-15546-thrifty-rung-order.test.ts — GREEN (3/3); covers the order helper and the flag only. The resolveAutoStrategy wiring has no end-to-end test (heavy deps).
• Existing area tests re-run green: combo-cost-blending, combo-quota-unreadable-15347, combo-speed-telemetry-6875, combo-quota-soft-penalty, auto-combo-budget-fallback-3470, auto-combo-hidden-models-4558, combo-resolve-auto-strategy-split, reset-aware-request-scope-12600.

Gates run

check-file-size, check-complexity, check-cognitive-complexity, typecheck:core, check:open-sse-typecheck, eslint (with suppressions) on changed files, prettier, husky pre-commit hooks.

⚠️ base-red inherited: #15306 — unit/integration/package-artifact gates timing out, vitest open-sse/mcp-server/tests/audit.test.ts, check:ai-attribution range error

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.