fix: preserve provider-required User-Agent on outbound requests, refs #2303 - #2501

…ooplj#2303 (looplj#2501)

The outbound transformer for channels like GitHub Copilot sets a
provider-required User-Agent (GitHubCopilotChat/...), but it never
reached the upstream on real calls:

1. The pipeline merged the inbound client's User-Agent into the
   outbound request, overwriting the transformer-set value.
2. The user-agent-pass-through middleware then forced the default
   axonhub/1.0 whenever pass-through was disabled (the default).

Channel checks bypass that pipeline, so they showed the correct UA
while real traffic went out as axonhub.

- llm/httpclient: treat User-Agent as a blocked header in
  MergeHTTPHeaders so the client UA is never auto-merged upstream;
  the pass-through middleware remains the single owner of client-UA
  forwarding.
- orchestrator: when pass-through is disabled, apply the axonhub/1.0
  default only when the transformer set no User-Agent. Pass-through
  enabled still forwards the client UA, and channel override headers
  still run afterwards.

…g client headers (#2635) (#2638)

The channel-level and global "pass through User-Agent" switch was inert for
codex channels because of two stacked causes:

1. The codex outbound transformer unconditionally copied the inbound client
   User-Agent back onto the outbound request (both the Responses path and the
   mirrored alpha-search path), so the client fingerprint always won before any
   policy layer ran.
2. After #2501 the orchestrator middleware only applies the axonhub default
   when the outbound request has no User-Agent at all. Since the transformer
   always produced one, the disabled branch never applied.

Fix the transformer side only, keeping #2501's contract intact: the transformer
now owns the UA and presents a Codex-client-like default
(codexDefaultUserAgent = "codex_cli_rs/" + codexDefaultVersion), symmetric with
how Version already defaults to codexDefaultVersion (#2591). Client-UA
forwarding remains solely owned by applyUserAgentPassThrough, whose
disabled-branch semantics are unchanged, so a transformer-set provider UA
(e.g. GitHubCopilotChat on Copilot channels) is still preserved when the switch
is off and the client UA still wins when it is on.

Also stop leaking client attribution headers: block the non-standard
Http-Referer spelling (the canonical Referer was already blocked) and the
client-private X-Zcode-* prefix. X-Title / X-Platform / X-Os-* are deliberately
left unblocked because OpenRouter-style channels legitimately use them.

Tests:
- codex outbound/alpha-search: outbound UA is the codex default and never the
  inbound client UA, including through the generic inbound-header merge.
- orchestrator: switch enabled -> client UA wins over the codex default;
  switch disabled -> the codex default survives; Copilot-preservation case
  still passes.
- httpclient: Http-Referer and X-Zcode-* are not merged into outbound headers.

…g client headers (looplj#2635) (looplj#2638)

The channel-level and global "pass through User-Agent" switch was inert for
codex channels because of two stacked causes:

1. The codex outbound transformer unconditionally copied the inbound client
   User-Agent back onto the outbound request (both the Responses path and the
   mirrored alpha-search path), so the client fingerprint always won before any
   policy layer ran.
2. After looplj#2501 the orchestrator middleware only applies the axonhub default
   when the outbound request has no User-Agent at all. Since the transformer
   always produced one, the disabled branch never applied.

Fix the transformer side only, keeping looplj#2501's contract intact: the transformer
now owns the UA and presents a Codex-client-like default
(codexDefaultUserAgent = "codex_cli_rs/" + codexDefaultVersion), symmetric with
how Version already defaults to codexDefaultVersion (looplj#2591). Client-UA
forwarding remains solely owned by applyUserAgentPassThrough, whose
disabled-branch semantics are unchanged, so a transformer-set provider UA
(e.g. GitHubCopilotChat on Copilot channels) is still preserved when the switch
is off and the client UA still wins when it is on.

Also stop leaking client attribution headers: block the non-standard
Http-Referer spelling (the canonical Referer was already blocked) and the
client-private X-Zcode-* prefix. X-Title / X-Platform / X-Os-* are deliberately
left unblocked because OpenRouter-style channels legitimately use them.

Tests:
- codex outbound/alpha-search: outbound UA is the codex default and never the
  inbound client UA, including through the generic inbound-header merge.
- orchestrator: switch enabled -> client UA wins over the codex default;
  switch disabled -> the codex default survives; Copilot-preservation case
  still passes.
- httpclient: Http-Referer and X-Zcode-* are not merged into outbound headers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>