feat(desktop): read a custom relay's model catalog before saving

[rootkiller6788]

Summary

A custom relay has no published model catalog — the only place its catalog can be read from is the endpoint the user is typing into the form, and there was no way to read it before the connection exists. The form therefore forced a hand-typed model id.

This adds a "read model catalog" action that probes the endpoint and key the user already filled in, then turns the default-model field into a chooser.

Nothing in the runtime host needed changing. The base-url plumbing for onboarding-verify landed upstream for managed-Host discovery, and it already runs the credential → catalog discovery this needs against a transient connection without persisting anything.

This change only wires the desktop side to it:

• an IPC handler
• a shared contract so main/preload/renderer cannot drift
• the row that offers the discovered models

The probe persists nothing and cannot break a reference. It targets connectionId: null against a transient connection — the same shape the post-create discovery fetch uses — so probing never creates, edits, or names a connection.

Staleness

The read is against whatever endpoint and key are in the fields at click time. If either changes while the probe is in flight, the result is discarded rather than attached to the new inputs — a picked model can never belong to a catalog probed from a different endpoint.

Rejected → form copy

The host returns a closed set of rejection reasons. Most map straight onto a sentence in the form:

• credential_not_configured
• base_url_not_configured
• provider_unsupported

One — connection_not_found — cannot describe this probe because it targets no existing connection, so it is folded into a generic failure instead of a reason the form cannot render.

Verification

Eight new tests, each rule pinned by reverting it:

$ node --test apps/desktop/dist/main/**tests**/provider-add-catalog-probe.test.js
ℹ tests 5
ℹ pass 5
ℹ fail 0

$ node --test apps/desktop/dist/main/**tests**/runtime-host-connections-ipc-main.test.js
ℹ tests 13
ℹ pass 13
ℹ fail 0

The following all pass:

npm run typecheck
npm run lint
npm run format:check
git diff --check
npm run check:asf-headers

The full workspace suite does not pass on this machine, and does not pass identically on a clean main — the failures are Windows-environment related:

• EPERM symlink
• EBUSY sqlite
• tar path resolution
• missing native binaries for Rive/computer-use
• macOS-only service tests
• three test files that hang in process isolation

I confirmed the biggest cluster by stashing this branch and rerunning goal-coordinator: it fails 8/8 on clean main exactly as it does here.

Unrelated to this change, reported rather than left unmentioned.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code — traced the existing onboarding-verify path to confirm the desktop was the only missing layer, wrote the shared contract, the IPC handler and its projection, the draft logic and the form row, and their tests. The commit carries a Generated-by trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No