feat(selfhost): support per-repo model overrides for ollama/openai/anthropic providers - #3965

Summary

• The per-repo reviewer model override (review.ai_model in .gittensory.yml) was wired end-to-end only for the two CLI-subscription providers (claude-code/codex). createOpenAiCompatibleAi (ollama/openai/openai-compatible) and createAnthropicAi bound their model ONCE at buildProvider() construction time from a global env var, with no per-call override parameter at all.
• Concretely: an operator running Ollama (or a BYOK OpenAI-compatible/Anthropic HTTP provider) across multiple repos had no way to set a stronger/cheaper model per repo the way claude-code/codex operators already could — a review.ai_model.ollama_model (etc.) config entry was silently ignored, with no warning, whenever the active provider wasn't claude-code/codex.
• Extended SelfHostAiModelConfig (packages/gittensory-engine/src/focus-manifest.ts — this type was extracted into the shared engine package; the miner package doesn't consume it, so this is gittensory-review-only) and AiRunOptions (src/selfhost/ai.ts) with ollamaModel/openaiModel/openaiCompatibleModel/anthropicModel, threaded through the full chain: focus-manifest parser → processors.ts → GittensoryAiReviewInput → AiRunCorrelation → runWorkersOpinion's ai.run() call → read per-call inside createOpenAiCompatibleAi/createAnthropicAi's own .run() — mirroring exactly how claudeModel/codexModel already work, at the same repo-override > global-env-var > hardcoded-default priority.
• Also extended the AI-review cache fingerprint (src/review/ai-review-cache-input.ts, version bumped v3→v4 following the file's own established precedent for adding a hashed field) so changing one of these new per-repo overrides correctly invalidates a previously-cached review instead of replaying a decision made under a different model.
• Scoped effort out: the CLI providers' claudeEffort/codexEffort have no equivalent for these HTTP-API providers (no existing effort-shaping mechanism to override — inventing one is a separate, larger feature).
• Left config/examples/gittensory.full.yml's commented ai_model: example block un-updated: that file sits at 65,478/65,536 bytes against MAX_FOCUS_MANIFEST_BYTES, ~58 bytes of margin — nowhere near enough room for 4 new documented keys without trimming unrelated comment text elsewhere in a 65KB shared file. Noting this explicitly rather than silently leaving the example incomplete (a known, pre-existing byte-budget fragility, also flagged in feat(regate-sweep): add opt-in oldest-first ordering mode to selectRegateCandidates #3867 earlier).

Found via a fresh performance/scalability/accuracy hardening audit of the self-host ORB stack. Tracked under #1667.

Scope

• packages/gittensory-engine/src/focus-manifest.ts — type, empty-config, parser, presence-check, serialization
• src/selfhost/ai.ts — AiRunOptions, createOpenAiCompatibleAi (+ new providerName field), createAnthropicAi, buildProvider
• src/services/ai-review.ts — GittensoryAiReviewInput, AiRunCorrelation, construction + spread sites
• src/queue/processors.ts — forward the 4 new fields from the resolved manifest
• src/review/ai-review-cache-input.ts — fingerprint fields + version bump v3→v4
• Tests: focus-manifest.test.ts (parser, all 8 knobs + each new one individually with round-trip), selfhost-ai.test.ts (per-provider override priority + buildProvider end-to-end wiring), ai-review-cache-input.test.ts (fingerprint changes per new field); fixed 2 pre-existing test files whose fixtures/assertions needed updating for the stricter type / bumped cache version

Validation

• npm run typecheck
• npm run test:coverage (full unsharded) — 561 files / 11120 tests passed; changed lines in every touched src/** file fully covered per lcov.info (cross-checked against diff hunks — zero overlap with pre-existing uncovered lines)
• git diff --check clean

Safety

• Absent/null override fields (the default — no .gittensory.yml ai_model.* set) are byte-identical to today: same global-env-var-then-hardcoded-default resolution as before this existed. No secrets; no new credential paths (only the model NAME can be redirected, never the API key/base URL, matching the existing claude/codex override's own scope).

Closes #3902