fix: restore claude-cli work silently dropped by FN-2370 squash and add audit guardrails

The FN-2370 auto-resolved squash (7c1a1c36c) reverted three commits' worth
of refinements to the claude-cli provider because the branch contained
rebased duplicates of commits already on main. The auto-resolver picked
the older side line-by-line and dropped the newer.

Restored:
- /api/models filter logic (was inverted; emptied every model picker)
- Claude Opus 4.7 catalog entry in pi-claude-cli
- Provider card status text and toast messages (no longer claim a restart
  is needed — the extension is always-loaded now)
- POST /api/auth/claude-cli returns restartRequired: false

Prevention:
- Regression tests on the /api/models useClaudeCli filter
- scripts/audit-squash-merge.mjs flags duplicate-cherry-pick risk and
  touched-file overlap on any squash commit
- AGENTS.md documents the rebase-before-squash rule and requires the
  merging agent to run the audit and triage every flagged item itself

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/workflow-steps.md

@@ -126,7 +126,7 @@ If a task is found in `in-review` with failed pre-merge workflow results and no
 
 Workflow status is visible in multiple places:
 
-- **Task cards**: workflow checks are shown after normal implementation steps in the step list; each workflow row is labeled (`Workflow · Pre-merge` / `Workflow · Post-merge`) and progress counts include both implementation and workflow checks
+- **Task cards**: workflow checks are shown after normal implementation steps in the step list; each workflow row uses the compact `workflow` badge label (while still retaining pre/post-merge styling semantics) and progress counts include both implementation and workflow checks
 - **List view (desktop + mobile)**: progress labels/bars use the same unified step model as task cards
 - **Task detail modal**: includes a **Workflow** tab when workflow data exists