fix: close three release-audit regressions from today's merge train

[lidge-jun]

Summary

A release-readiness hard audit (grok-4.6 + gpt-5.6-sol workers, full local gates) of everything landed since v2.25.0 found three blocking regressions introduced by today's merges. This closes all three:

1. Keep-alive re-arm (post-fix(grok): switch to Responses backend and backfill required annotations #1941). codex-rs's idle timer is timeout(idle_timeout, stream.next()) over an eventsource stream that parses at the EVENT level — the comment-line keep-alive fix(grok): switch to Responses backend and backfill required annotations #1941 introduced dispatches no event and never re-arms it (the 110_codex-stream-stability RCA had already proven this). Default returns to the typed response.heartbeat frame (ignored by codex-rs's catch-all); the grok surface — whose strict async-openai decoder dies on unknown variants but tolerates comments — opts into comment style via a new heartbeatStyle bridge option threaded from logCtx.surface.
2. WHAM-wins plan provenance (post-fix(codex): re-derive pool plan from JWT chatgpt_plan_type (#1989) #1998). The JWT plan re-derivation could overwrite a live WHAM-sourced plan on the next token refresh or startup reconcile (the in-memory dedupe map does not survive restarts, and generation gating is credential-CAS only). plan writes now persist provenance (planSource + planCredentialGeneration); JWT writes are refused while a WHAM observation exists for the same credential generation, and a token refresh (newer generation) legitimately reopens the window. Steady-state refreshes remain write-free.
3. Unclassified chat-wire tier projection (post-feat(fastwire): B1 — separate Fast capability from caller-tier forwarding (#1886) #1965). Retiring legacyChatEligibility flipped no-config openai-chat providers from a projected false to undefined, which broke require.serviceTier: "unsupported" routing matches for groq/ollama-class providers (default unknownEvidence.capability: "exclude" then drops them). An unclassified chat route whose final adapter will not forward any tier projects false again; chatServiceTier: true and Responses-wire unclassified keep the historical unknown, preserving B1's three stated behavior changes.

Verification

• 11 focused suites (bridge lifecycle/core, chat endpoint, grok inject, fastwire x4, service-tier, codex-plan, codex-auth-api): 705 pass / 0 fail
• bun x tsc --noEmit clean
• New regression tests: typed-default + grok-comment keep-alive split; WHAM same-generation fence, newer-generation reopen, restart persistence; unclassified chat/Responses projection triple

Checklist

• Focused regression tests added for each fix
• Typecheck green
• No GUI change (no screenshot required)
• Docs impact: none user-facing (wire/internal semantics restored to pre-regression contract)

[github-actions]

✅ Deterministic PR hygiene checks passed.