Ignore inherited provider and Bot registry entries

[charan-rathore]

What this changes

shared/model-providers.ts uses plain objects as registries. Looking up constructor or __proto__ can return an inherited object rather than a configured row. botSettings("__proto__", {}) returns undefined provider/model fields instead of the existing missing-Bot error.

Require an own property before reading either registry. Unknown providers return undefined, and missing Bot names throw the existing startup error. Defaults, normalization, environment overrides, and registered entries keep their existing behavior. This is a small correctness fix, not a claim of exploitable prototype pollution. No issue was filed.

Where it runs

• New state that outlives a request: none. The existing read-only registries are unchanged.
• Second replica: performs the same own-property check against its checked spec file and returns the same result.
• Anything serialised: no writes or coordination added.
• Browser fan-out: none.
• New listener, port, or schedule: none.

Boundary and audit

• Acting calls: none added; gateway behavior unchanged.
• Refusals/failures: uses the existing configuration error, before a Bot starts. No request-level action or new audit path.
• Client trust: none added.

Changelog

• Added an Unreleased note describing corrected unknown-name behavior.

Proof

Bun 1.3.14, fresh main, frozen root dependency install, and the repository's normal test preloads:

• New regressions on unchanged implementation: 28 pass, 2 fail.
• Patched bun test ./shared/model-providers.test.ts: 30 pass, 0 fail, 93 assertions.
• Full bun run lint and bun run format:check: pass.
• Full bun run test:ci: attempted twice, timed out at 65 and 110 seconds. A direct bun run test also timed out at 55 seconds; no full-suite pass claimed.
• Workspace typecheck: worker passed; app/server were killed (exit 137). Separate server typecheck exhausted Node's heap (exit 134). No full typecheck pass claimed.
• Build: attempted, worker passed, server killed; overall command timed out at 35 seconds. No full build pass claimed.
• Database integration, live providers, browser deployment and platform checks were not verified. No dedicated test PostgreSQL instance was configured.

[charan-rathore]

Refreshed onto latest main. The CHANGELOG conflict is resolved. I re-ran only the changed test file locally (shared/model-providers.test.ts, 30 pass); CI will cover the rest.

[davidmckayv]

The current head 02362e1 matches the accepted source disposition from the refreshed triage. Required CI must pass before landing.