[WRONG BRANCH] fix: enforce native chat effort caps without pins - #469

Motivation

• A native Chat path only applied effort caps when an operator pin resolved, which let qualifying unpinned requests bypass configured hard ceilings and raise upstream inference effort. This change restores the documented hard-ceiling semantics for v2 and spawned-child turns.

Description

• Evaluate and apply the effort cap independently of whether an operator pinned value resolved by moving cap logic outside the pin-only branch in src/server/chat-native.ts and ensuring wire normalization runs when either a pin or cap changes the effort.
• Add a normalizeForWire flag so provider wire mapping via mapReasoningEffort happens whenever pinning or capping altered the effective effort, preserving passthrough spelling for unqualified caller values.
• Update the integration regression in tests/codex-integration/model-pinned-effort.test.ts to assert that a qualifying unpinned spawned-child request is capped (ultra -> low) while an otherwise identical unqualified request still preserves the caller spelling.

Testing

• Ran bun run typecheck and it passed.
• Ran bun run privacy:scan and it passed.
• Ran git diff --check and it passed.
• Attempted the focused test bun test tests/codex-integration/model-pinned-effort.test.ts but test collection failed in the current environment because the available Bun runtime lacks the node:zlib zstdDecompressSync export; the updated test is included in the PR and will be exercised by CI where the expected Bun runtime is available.

Codex Task