fix: resolve 25 pre-publish blockers

- postinstall.mjs: fix alias package detection
- migrate-legacy-plugin-entry: dedupe + regression tests
- task_system: default consistency across runtime paths
- task() contract: consistent tool behavior
- runtime model selection, tool cap, stale-task cancellation
- recovery sanitization, context-limit gating
- Ralph semantic DONE hardening, Atlas fallback persistence
- native-skill description/content, skill path traversal guard
- publish workflow: platform awaited via reusable workflow job
- release: version edits reapplied before commit/tag
- JSONC plugin migration: top-level plugin key safety
- cold-cache: user fallback models skip disconnected providers
- docs/version/release framing updates

Verified: bun test (4599 pass), tsc --noEmit clean, bun run build clean

src/tools/delegate-task/model-selection.ts

@@ -59,6 +59,8 @@ export function resolveModelForDelegateTask(input: {
     return { model: userModel }
   }
 
+  const connectedProviders = input.availableModels.size === 0 ? readConnectedProvidersCache() : null
+
   // Before provider cache is created (first run), skip model resolution entirely.
   // OpenCode will use its system default model when no model is specified in the prompt.
   if (input.availableModels.size === 0 && !hasProviderModelsCache() && !hasConnectedProvidersCache()) {
@@ -77,7 +79,15 @@ export function resolveModelForDelegateTask(input: {
     }
 
     if (input.availableModels.size === 0) {
-      return { model: categoryDefault }
+      const categoryProvider = categoryDefault.includes("/") ? categoryDefault.split("/")[0] : undefined
+      if (!connectedProviders || !categoryProvider || connectedProviders.includes(categoryProvider)) {
+        return { model: categoryDefault }
+      }
+
+      log("[resolveModelForDelegateTask] skipping disconnected category default on cold cache", {
+        categoryDefault,
+        connectedProviders,
+      })
     }
 
     const parts = categoryDefault.split("/")
@@ -95,9 +105,19 @@ export function resolveModelForDelegateTask(input: {
   const userFallbackModels = input.userFallbackModels
   if (userFallbackModels && userFallbackModels.length > 0) {
     if (input.availableModels.size === 0) {
-      const first = userFallbackModels[0] ? parseUserFallbackModel(userFallbackModels[0]) : undefined
-      if (first) {
-        return { model: first.baseModel, variant: first.variant, matchedFallback: true }
+      for (const fallbackModel of userFallbackModels) {
+        const parsedFallback = parseUserFallbackModel(fallbackModel)
+        if (!parsedFallback) continue
+
+        if (
+          connectedProviders &&
+          parsedFallback.providerHint &&
+          !parsedFallback.providerHint.some((provider) => connectedProviders.includes(provider))
+        ) {
+          continue
+        }
+
+        return { model: parsedFallback.baseModel, variant: parsedFallback.variant, matchedFallback: true }
       }
     } else {
       for (const fallbackModel of userFallbackModels) {
@@ -115,7 +135,6 @@ export function resolveModelForDelegateTask(input: {
   const fallbackChain = input.fallbackChain
   if (fallbackChain && fallbackChain.length > 0) {
     if (input.availableModels.size === 0) {
-      const connectedProviders = readConnectedProvidersCache()
       if (connectedProviders) {
         const connectedSet = new Set(connectedProviders)
         for (const entry of fallbackChain) {