fix(models): use resolved runtime headers for catalog hooks (#141402)

fix(models): use resolved runtime headers for catalog hooks (#141402)

Valid provider header SecretRefs could fail catalog discovery as unresolved even after runtime secret materialization. The shared catalog context now gives the active provider hook its matching runtime headers and request settings while preserving source credential selection and other providers' configuration. Generated model planning retains source secret markers.

Validation:
- A current-main regression failed through the real model plan/discovery/callback path before the fix. The paired runtime/source case and genuine unresolved control now pass.
- 95 auth/provenance tests, 11 runtime/source persistence tests, and 4 targeted Copilot header controls passed. The two new cases were then moved to a separate file to satisfy the line limit and both passed there.
- The real source CLI (`models list --provider github-copilot --all --json`) resolved synthetic header references, made authenticated HTTPS account/catalog requests through a local fixture, listed the returned model, and preserved the authored references. No real provider account or inference was used. This read-only command does not write generated model files; those persistence controls ran separately.
- Pinned formatting, focused lint, boundary checks and shrink ratchets passed. Type checks and builds are left to CI.

The earlier built Gateway failure is retained as baseline evidence. Two source Gateway proof attempts stopped on loader setup errors; they are not claimed as successful proof. The unrelated source worker loader issue is recorded separately. No credential ordering, header validation, endpoint policy or provider-specific resolver changes.

Co-authored-by: Ayaan Zaidi