fix: address ds-review-bot v8 findings

- llm-deepseek: the uncatalogued resolveModel fallback declares text-only
  modalities — the wire route is text-only regardless of catalog
  membership, so "unknown" must not let the host persist-then-fail images.
- session.selectModel also consults the pending-inbox mirror: a queued
  image prompt enters the log only when claimed, after a switch would land.
- attachment store: ensureDurableDirectory syncs every ancestor entry up to
  a caller-vouched boundary regardless of what mkdir reports — a raced
  "already existed" is not "already durable".
- One image walker (imageBlockIn/imageInEvent) now serves both attachment
  authorization and the selection gate; referencedImage therefore also
  authorizes references inside wrapped message content.
- InputHub: the scope disposer resolves the conversation service optionally
  (teardown/HMR must reach quiescence), and a send failing after its scope
  died releases the in-flight drafts instead of restoring them onto a
  disposed shell.
- http-bridge destroys declared-oversize requests with connection: close
  instead of draining a body the client can trickle indefinitely.
- LlmService validates AND detaches modality arrays identically on the
  advisory and exact routes; READMEs record the fourth INVALID_MODEL_INFO
  rejection reason.
- CLI provider docs (JSDoc, README pair, Agent Note pair) describe the
  reuse behavior; llm-route.spec now parses the SHIPPED cordis.yml through
  the production extraction, pinning the row coupling.
- image-display lane pins gallery/rail shape in inline snapshots and the
  object-URL scheme this environment must take; stale host.schema comment
  dropped.

apps/cli/tests/llm-route.spec.ts

@@ -1,6 +1,7 @@
 /** resolveLlmRoute: layered provider/model resolution and the dynamic pi-ai mount decision. */
+import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
-import { resolveLlmRoute } from '../src/app-cli-entry.ts'
+import { parseIncludeYmlRows, resolveLlmRoute, ymlPiAiProvidersOf } from '../src/app-cli-entry.ts'
 
 /** The shipped yml shape: DeepSeek gateway default plus a pi-ai row routing openai/anthropic. */
 const SHIPPED = {
@@ -52,6 +53,20 @@ describe('resolveLlmRoute', () => {
     })).toThrow(/provider anthropic requires an explicit model/)
   })
 
+  it('reuses the SHIPPED cordis.yml roster — the coupling that prevents the duplicate-adapter boot failure', () => {
+    // Parsed from the real file through the production extraction, not a
+    // literal roster: renaming the `llm-pi-ai` row or its providers field
+    // must fail here, because composePatches reads exactly these shapes.
+    const rows = parseIncludeYmlRows(join(import.meta.dirname, '..', 'cordis.yml'))
+    const roster = ymlPiAiProvidersOf(rows)
+    expect(roster).toEqual(['openai', 'anthropic'])
+    const gateway = (rows.get('api-gateway')?.config ?? {}) as { provider?: unknown; model?: unknown }
+    expect(resolveLlmRoute({
+      cli: { provider: 'anthropic', model: 'claude-opus-4-8' }, profile: {},
+      gateway, ymlPiAiProviders: roster,
+    })).toEqual({ provider: 'anthropic', dynamicPiAiProvider: undefined })
+  })
+
   it('fails loud on a missing or empty provider', () => {
     expect(() => resolveLlmRoute({ cli: {}, profile: {}, gateway: {}, ymlPiAiProviders: [] }))
       .toThrow(/provider must be a non-empty string/)