fix: normalize Remote Control session providers at creation

[Rat0323]

Summary

• Complement fix: route Remote Control sessions through mixed relay #1666 by assigning phone-created Remote Control sessions to the active provider at thread/start, before app-server persists the thread.
• Enable the automatic override only for official-mix profiles: official login supplies Remote Control while model requests use a custom API.
• Keep launcher-time Provider Sync as migration/recovery fallback.
• Include fix(ci): keep upstream theme assets LF-normalized #1735's .gitattributes LF fix for stable CI checkouts.

Root cause

Phone-created threads could start with modelProvider = openai even though the official-mix profile used a custom provider. Rollout/SQLite state and local_thread_catalog then disagreed with the active provider, so the session remained on disk but disappeared from the active list after restart.

Implementation

Creation-time normalization

For relayMode = official with officialMixApiKey = true, the injected app-server request layer intercepts thread/start and host aliases, replaces a missing or openai modelProvider with the active provider, preserves other explicit providers, and forwards the request before persistence.

The override is independent of model-whitelist and service-tier UI switches, and app-server client discovery retries until its runtime module is available. Pure official, Mixed API, Pure API, and Aggregate profiles do not automatically enable this Remote Control-specific path.

Startup recovery

Launcher-time Provider Sync is automatically invoked only for official-mix profiles. Other modes keep the existing opt-in provider_sync_enabled behavior. The sync repairs older rollout/SQLite mismatches and missing catalog rows with its existing backup behavior.

Validation

• Current experimental app-server schema confirms ThreadStartParams.modelProvider.
• node --check assets/inject/renderer-inject.js
• cargo fmt --all -- --check
• git diff --check
• cargo test -p codex-plus-core --test cdp_bridge -- --test-threads=1 — 94 passed
• Provider override coverage includes missing/openai, explicit other provider, disabled service-tier controls, pure official, and direct app-server client calls.
• Launcher predicates verify official-mix runs automatically while pure official, Mixed API, Pure API, Aggregate, and disabled relay profiles are skipped — 4 passed.
• Previous recovery flow verified with session 019fd56e-2eca-7f10-9c06-47e1dbf860f9.