fix(models): unify gateway model discovery

[Sayt-0]

Summary

Unify models-gateway discovery semantics between docker agent models and the interactive /model picker.

A non-empty /v1/models response is now the source of truth for gateway-routed models. Discovery failures fall back independently to directly usable providers, aliases, custom providers, and the catalog without requiring a Docker Desktop token for generic gateways.

Expected behavior

Expectation	Implementation
Query gateway models from the CLI	docker agent models calls <gateway>/v1/models through modelsgateway.ListModels
Preserve arbitrary providers	Prefixed provider/model IDs are preserved; no provider allow-list is used
Apply live filtering	--provider filters normalized gateway results
Exclude unsuitable models	Shared normalization removes embeddings and catalog-declared non-text models
Deduplicate deterministically	Canonical references are deduplicated while retaining gateway response order; final CLI output remains deterministically sorted
Handle discovery failures	404, empty or invalid responses, timeout, and authentication failures trigger the documented direct-provider/catalog fallback
Keep direct and custom providers usable	Credential-based discovery is shared by CLI fallback and runtime; custom endpoints remain independent sources
Support generic gateways	Docker Desktop authentication is requested only for trusted Docker URLs
Preserve Docker Model Runner behavior	Runtime DMR discovery/cache and intentional CLI DMR omission are unchanged
Preserve output behavior	Table/JSON output, --all, default marking, aliases, env credentials, env files, and user-config providers remain supported

Implementation

• Add a lightweight shared gateway normalization primitive in pkg/modelsgateway.
• Add a discovery-only provider availability helper in pkg/config without changing config.AvailableProviders or model auto-selection.
• Reuse the shared normalization in the CLI and runtime picker while keeping caller-specific cache policies.
• Document authoritative live discovery and fallback behavior in the CLI reference.

Tests

Hermetic coverage includes:

• multi-provider live gateway discovery and --provider filtering;
• trusted Docker and generic gateway authentication;
• 404, empty response, invalid JSON, timeout, and missing authentication;
• direct providers, provider aliases, and authenticated/unauthenticated custom providers;
• embedding/non-text filtering, deduplication, provider casing, deterministic JSON/table output, and default marking;
• runtime gateway fallback and cache behavior.

Validation completed:

• task build
• task lint
• task test

No model generation or real provider API calls are used by the added tests.

Scope

• No agent-file argument was added to docker agent models.
• Named models and bypass_models_gateway remain runtime-only concerns.
• Docker Model Runner live behavior is unchanged.
• Model routing and generation execution are unchanged.