Upstream sync: test isolation, Cursor crash fix, pricing corrections - #36

Two defects, both measured on the maintainer's machine. Upstream fixed the
same two (d6d24a0, 671c1ec); these are ports against this fork.

The usage cache defaults to the real Application Support usage-cache.json
and had no gate, so any test that ran real providers read and rewrote it.
With the app quit, one full suite run changed the real file from 726,929 to
763,881 bytes. Every test run in this fork had been modifying user data.
Path injection cannot catch this: it covers the test that injects, not the
process. AppEnv.persistsToUserLocation now owns the rule (an injected path
always persists, the default path only inside the app) and the cache obeys
it. Measured again after the gate: no state file changes across a full run.
The companion save was never at risk, since its tests all inject a path.

UsageStore defaults its limits providers to the real ones, and about ten
tests build a store without a stub. Whenever the Keychain grant happened to
be live, a refresh in one of those called api.anthropic.com with the user's
real token and spent their rate limit. AppEnv.allowsLiveLimitsFetch now gates
the real Claude and Antigravity fetches before any Keychain read, allowing
them only in the app or with PTB_PARITY=1.

The gate made the two Keychain-discipline tests hollow: blocking before the
provider runs makes 'the automatic path never reads the Keychain' true for
the wrong reason. Both now open the gate with KeychainReader stubbed, so the
provider's real logic runs against a fake Keychain. The manual-path test had
been querying the real Keychain with prompts allowed during swift test.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

LocalAdditionalUsageProvider has its own copy of intValue, separate from the
LocalUsageReader one that got an upper bound after an overflow crash. This
copy had a floor but no ceiling, and NSNumber.intValue saturates at Int.max,
so parseCursorBubble's 'input + output' trapped on a corrupt Cursor record.
Verified: SIGTRAP with the old helper, clean parse with the clamp.

Uses LocalUsageReader.maxParsedTokenValue rather than a second limit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

chattymin#309)

This fork kept the model-family price fallback, so nothing showed as
Unavailable, but the fallback was wrong for two models. claude-opus-5-5 was
billed at Opus 5's rate (5, 25, 6.25, 0.5) instead of (4, 20, 5, 0.2): 25%
high on input, output and cache writes and 2.5x high on cache reads, which
dominate real usage. claude-sonnet-5 fell back to Sonnet 4's rate, 1.5x high.
Opus 5 happened to match the fallback and is now explicit so it cannot drift.

Also adds gemini-2.5-flash-lite. Verified by injection: without the Opus 5.5
row a million cache reads cost 0.5 instead of 0.2.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Seven taken or ported (the Cursor token clamp, two test-isolation fixes,
pricing rows, hiding zero-token providers). Two declined on security grounds,
both built on the session key declined as chattymin#241. The rest are skipped (tool
not installed, or already present), declined (release process, or changing
existing behaviour by design), or deferred.

Adds a 'deferred' disposition: wanted in principle but colliding with how far
the fork has diverged, so it needs a deliberate port rather than a
cherry-pick. Forty of the attempted commits conflicted, concentrated in
Localization, CompanionStore, PopoverView and CompanionView, which is where
porting would risk existing features.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

testStartTransitionsThroughConnectingToWatching failed intermittently on CI
('expected watching, got connecting'), including on main at fac7ea0, a commit
that only bumps a version string. It passed locally.

The stub serves responses from a shared static queue, and each store polls
every 10ms. Only one of the four spectator tests stopped its store, so stores
from earlier tests kept polling and removeFirst() took the next test's queued
response first. That test's own store then got an empty body and never left
connecting. Timing-dependent, hence CI-only.

Every store created by these helpers is now stopped at teardown, and the queue
is reset per test. BattleStoreTests copied the same pattern and stopped none
of its stores; not yet triggered, but the same mechanism, so fixed there too.

25 consecutive runs of both classes: 0 failures.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>