fix(server): remove retired models after Codex refresh

[rynfar]

Codex models removed from the CLI catalog stayed in Pylon’s cached model picker. Successful discovery now replaces that inventory; startup and transient failures retain the last discovered models. Sign-out, disable, uninstall, and empty successful discovery clear stale entries.

Adapts upstream #9773, bfef973d9ec64e580fff4197ac53085207471ffd, to Pylon’s provider maintenance APIs. Other provider inventory policies are preserved. The shared registry serves every client and connection mode.

Validation: 78 tests across ProviderRegistry, providerStatusCache, and CodexProvider pass, including persisted removals across failure and restart. Server typecheck and targeted formatting/lint pass.

Model: GPT-6 Astra. Harness: Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.7 KiB	+14 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+12 B (+0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.5 KiB	56.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.7 KiB	13.8 KiB	+174 B (+1.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−2 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.7 KiB	+176 B (+2.6%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.3 KiB	58.2 KiB	+928 B (+1.6%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: 6466561 · PR result: 79d04b1 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.