fix(pi): contain malformed extension model metadata

[yaacovcorcos]

User effect

Pi model discovery now contains malformed extension metadata per model instead of losing the whole catalog. Display-only names are trimmed or given safe fallbacks; provider/model identities remain byte-for-byte resolvable. Blank, trim-mutating, or slash-ambiguous provider identities are omitted so one row cannot select a different provider/model.

Donor provenance and disposition

• Reimplemented from Emanuele-web04/synara commits f5ec4b65f3ba98cc716c5f9890194dcda8f7cbda, 2f33cd70a3a01750dc7d429747541b5417c03997, and f41a68a28b0e0d8f03bc85055b7836bf50ee611f (MIT).
• Disposition: bounded Scient-native adaptation, not cherry-pick or ancestry intake.
• Review evidence: ScientFactory/Scient#78.
• No donor identity, credentials, storage, sessions, migrations, UI, release authority, automation, or dependencies are imported.

Exact revision and file impact

• Base: 3829e5dd82a4760184aabafa4c96127744ef79f2
• Head: 32eb90fd804d7e9feeaa06b20e97c20c70a98601
• Branch: fix/upstream-pi-model-metadata-20260803
• Production: apps/server/src/provider/Layers/PiAdapter.ts (+50/-22), adding the descriptor containment and identity round-trip boundary.
• Tests: apps/server/src/provider/Layers/PiAdapter.test.ts (+120), adding valid identity, display normalization/fallback, malformed identity, provider-slug collision, and thinking-metadata regressions.
• Total: 2 files, +170/-22.

Verification

• Focused baseline 6/6; final focused 13/13.
• Full owning server suite: 233 files passed, 2 skipped; 2,959 tests passed, 10 skipped.
• Repository-wide bun run test: all 12 Turbo tasks passed in 3m17s.
• Server typecheck, scoped format, scoped lint (0 errors; 6 inherited warnings), server build, and git diff --check: passed.
• No computer use, browser automation, screenshots, rendering, geometry checks, visual tests, visual-regression tests, or manual UI acceptance were performed.

Independent reviews

Exactly three non-author, read-only reviews inspected the exact final base/head:

1. Correctness/reliability/concurrency/lifecycle/performance: certified; no unresolved P0-P2.
2. Security/privacy/data/credentials/sessions/permissions/release: found one P2 where a slash-bearing provider ID could collide with another provider/model. The provider boundary and exact regression were added; final head recertified with no unresolved P0-P2.
3. Architecture/maintainability/Scient identity/lineage/test sufficiency/fast-lane eligibility: certified; no unresolved P0-P2.

Rollback, limitations, and dependency status

• Rollback: revert the two branch commits; no migration, data repair, credential change, or live-state rollback is required.
• Malformed extension identities are intentionally omitted rather than rewritten; valid model IDs may still contain /.
• The lane is independently mergeable from the exact owned base and is not stacked on the evidence or checkpoint branches.
• Hosted CI: Release Smoke, Linux/Windows HTML Preview Platform Smoke, and Windows Process Regression passed. The aggregate job stopped before format/tests/browser/build at the unchanged release-lineage gate because the reviewed manifest expects 80 protected tags and the official refs now contain 81; that separate release-lane drift is not caused by this two-file change.
• Draft only: do not merge, approve, mark ready, auto-merge, release, or publish.