fix: restore claude-cli work silently dropped by FN-2370 squash and add audit guardrails

The FN-2370 auto-resolved squash (7c1a1c36c) reverted three commits' worth
of refinements to the claude-cli provider because the branch contained
rebased duplicates of commits already on main. The auto-resolver picked
the older side line-by-line and dropped the newer.

Restored:
- /api/models filter logic (was inverted; emptied every model picker)
- Claude Opus 4.7 catalog entry in pi-claude-cli
- Provider card status text and toast messages (no longer claim a restart
  is needed — the extension is always-loaded now)
- POST /api/auth/claude-cli returns restartRequired: false

Prevention:
- Regression tests on the /api/models useClaudeCli filter
- scripts/audit-squash-merge.mjs flags duplicate-cherry-pick risk and
  touched-file overlap on any squash commit
- AGENTS.md documents the rebase-before-squash rule and requires the
  merging agent to run the audit and triage every flagged item itself

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/pi-claude-cli/index.ts

@@ -71,7 +71,7 @@ export default function (pi: ExtensionAPI) {
     validateCliPresence(); // throws if CLI not on PATH
     validateCliAuth(); // warns if not authenticated
 
-    const models = getModels("anthropic").map((model) => ({
+    const catalogModels = getModels("anthropic").map((model) => ({
       id: model.id,
       name: model.name,
       reasoning: model.reasoning,
@@ -81,6 +81,28 @@ export default function (pi: ExtensionAPI) {
       maxTokens: model.maxTokens,
     }));
 
+    // Newer models released after the pinned @mariozechner/pi-ai catalog
+    // was generated. Dedupe by id so this list is harmless once the upstream
+    // catalog catches up.
+    // https://platform.claude.com/docs/en/about-claude/models/overview
+    const extraModels: typeof catalogModels = [
+      {
+        id: "claude-opus-4-7",
+        name: "Claude Opus 4.7",
+        reasoning: true,
+        input: ["text", "image"],
+        cost: { input: 5, output: 25, cacheRead: 0.5, cacheWrite: 6.25 },
+        contextWindow: 1_000_000,
+        maxTokens: 128_000,
+      },
+    ];
+
+    const seen = new Set(catalogModels.map((m) => m.id));
+    const models = [
+      ...catalogModels,
+      ...extraModels.filter((m) => !seen.has(m.id)),
+    ];
+
     // Ensure all registered tools are active so pi can execute them.
     // Some tools (find, grep, ls) are registered but not activated by default.
     pi.on("session_start", async () => {