Add BYOK providers and harden launcher

[TheStreamCode]

What changed - add documented presets for OpenRouter, Moonshot AI/Kimi, Alibaba Model Studio Token Plan, and Tencent Cloud Token Plan - update Z.ai defaults and align Copilot BYOK environment variables with current official documentation - add offline mode and OpenAI completions/Responses wire API selection - harden Windows process spawning, provider configuration validation, secret sanitization, catalog authentication, and request timeouts - prefer the standalone npm Copilot CLI over the stale VS Code shim when both are on PATH - add a provider JSON Schema, reproducible verification matrix, updated security/contribution guidance, CODEOWNERS, and cross-platform CI - pin GitHub Actions to immutable commits and remove the inactive Dependabot auto-merge workflow ## Why The launcher needed current provider coverage and compatibility with recent Copilot CLI BYOK releases. The review also found a Windows shell-injection risk, unsafe cross-origin catalog credential forwarding, stale BYOK variable usage, incomplete config validation, and a PATH collision with the VS Code Copilot shim. ## Impact Users can select the new providers through built-in aliases, opt into offline or Responses mode, and use an npm-installed Copilot CLI without manually overriding COPILOT_BIN. Provider credentials remain isolated to the child process and verified catalog origin. ## Verification - npm ci - npm run check: 39/39 tests passed - npm run test:coverage: 86.63% lines, 78.33% branches, 88.89% functions - npm audit --omit=dev --audit-level=high: 0 vulnerabilities - npm pack --dry-run - authenticated Chutes and OpenCode Go catalogs - Chutes end-to-end Copilot CLI 1.0.77 inference completed with exit code 0 - OpenCode Go reached the provider but generation was not completed because the available account quota was exhausted - documented endpoint reachability checks for every built-in provider