feat(platform): adaptive chat reliability and blue-green deploy tiers

[yannickmonney]

Summary

A consolidated batch that had accumulated on this branch, opened as one PR per request. It spans
two headline pillars plus supporting governance / model-catalog / accessibility work. Grouped by theme
below so it can be reviewed pillar-by-pillar.

Note: this intentionally bundles several features into one PR (against the usual atomic-PR norm) at
the requester's direction. Each pillar is independently described. The branch also carries a separate
fix: issues commit — an icon-button accessibility migration (a shared IconButton primitive with a
built-in tooltip, adopted across ~28 call sites).

Pillar 1 — Adaptive chat reliability

• Shared chat-error contract (lib/shared/chat-errors.ts): one pure module classifies and encodes
  generation errors, used by both the Convex backend and the chat UI. message.error now carries a
  structured, localizable TALE_ERR1 envelope instead of a raw string.
• Resource-scoped provider failover (convex/providers/, failure_scope.ts): deterministic
  failures retire a single credential/endpoint rather than a whole provider, with a structured
  fallback envelope surfaced to the UI.
• Structured model-fallback notice + auto-switch in the composer, with new modelFallback* strings.
• Adaptive reasoning router: the Auto router emits a coarse reasoning seed (effort/creativity)
  blended into the governor's difficulty prior. The per-agent manual Response Tuning override and
  its settings tab/route are removed; the governor gains anti-oscillation (lastTier) + cold-quality
  self-correction.
• Composer rework: pasted images become inline [N] reference tokens; legacy screenshot capture
  removed; the new-chat shortcut/button moves from the chat header to the nav rail.

Pillar 2 — Blue-green deploy tiers + CLI version model

• 3-tier tale deploy: -a/--all → --stop; convex always rolls; db/proxy stop-gated;
  platform blue-green; sandbox/sandbox-egress flip via a new zero-gap path.
• Zero-gap sandbox blue-green flip (CLI flip-sandbox.ts + spawner SANDBOX_COLOR, /v1/drain,
  colour-aware cancel via sandboxExecutions.spawnerColor).
• CLI version lifecycle: tale upgrade → tale update (CLI self-update + file-sync only;
  rolls the binary back on sync failure). Automatic CLI↔instance version alignment (lib/version/align.ts).
• Rollback confirmation gate: tale rollback requires -y/--yes.

Pillar 3 — Governance config, model catalog, UI a11y

• Governance retention consolidation: standalone retention-policy.json folded into a policy
  block of retention.json with a legacy read fallback; six policy editors refactored onto a shared
  Zod config-parser + an optimistic instant-save toggle hook.
• Model catalog sync: expanded frontier-vendor set; the weekly updater regenerates the docs tables.
• Accessibility / UX pass: the shared Button enforces labels on icon-only buttons (with a
  working built-in tooltip); the zoom-pan viewer toolbar is rebuilt on shared primitives.
• Docs + i18n swept across en/de/fr for every user-visible change; dev-engine auto-starts a
  stopped Docker engine.

Schema / migrations

All four Convex schema changes are purely additive optional fields with legacy-row coalescing
(autoRouteCache.seed, sandboxExecutions.spawnerColor, threads/reasoning_profiles bucket
lastTier) — no data migration required. Knowledge-DB (Postgres) schema unchanged → N/A.

Self-review + CodeRabbit — fixes applied

This PR was reviewed by an adversarial multi-agent self-review (11 confirmed findings) and CodeRabbit
(local CLI, 25 findings; 1 was a verified false-positive). Fixes pushed in the two fix(platform)
commits on top of the feature commit:

• Windows self-update rollback — replaceBinaryWindows returned ${installPath}.old but created
  tale.old.exe, so commit/rollback hit a nonexistent path; now one consistent, name-agnostic backup.
• Sandbox runtime image on default deploy — the runtime/sandbox images stopped being pulled +
  retagged once the sandbox tier moved off statefulToUpdate, breaking the first /v1/execute after a
  bump; now derived from the actual flipSandboxTier roll.
• Button tooltip never opened — the Radix Trigger wrapped SkeletonBox (a plain span that drops
  the injected ref/handlers); it now wraps the real ButtonBase.
• failure_scope crash — tolerate a missing apiKey/baseUrl (keyless providers).
• Adaptive lastTier fallback, signal-killed update exit code, drain-status response
  validation, SSE header precedence, paste image double-insert, video-URL unhandled
  rejection, a literal NUL byte in auto_route_helpers, Knip dead exports, and several
  silent catches → all fixed. Tests updated to the new error-envelope / [MODEL_FALLBACK] contracts.

Deferred (tracked) — intentionally not in this PR

• /v1/drain is unauthenticated — a deliberate trust assumption (the spawner port is never
  host-exposed). Documented; HMAC-gating it is a follow-up if that assumption changes.
• mergeRetentionPolicy on a fresh org without a bounds catalog — an edge-case in the
  actively-evolving governance file-config flow; left for the owner of that refactor to avoid a wrong
  fix to the bounds-seeding path.
• A few LOW nits (a no-op setSpawnerColor round-trip in single-colour mode, a dropped {model} i18n
  param, two test-only helper exports) — noted, non-blocking.

Definition of Done

• bun run check — typecheck (13/13) + Knip + targeted tests run locally; full lint/test suite green in CI.
• bun run lint:sast (Opengrep) — clean (pre-commit gate + CI Opengrep/Opengrep-OSS green).
• Data-model change ships its migration — N/A: additive optional fields with reader coalescing.
• bun run test:e2e — Playwright runs in CI; the automation* spec failures are pre-existing
  infra flakiness (WebServer ECONNRESET / convex-push / TALE_CONFIG_DIR), unrelated to this diff.
• Loading uses <Skeletonize> — no new hand-rolled skeletons.
• Updated messages/{en,de,fr}.json — 5812 leaf keys verified in parity.
• Updated /docs/{en,de,fr}/ for user-visible changes (CLI verbs, deploy tiers, models, retention).
• Tests carry the change — unit tests for the new units; failing pre-existing tests updated to the new contracts.
• Updated README.md (CLI command surface).
• Verified the real outcome — gate run locally + CI; review fixes re-validated (typecheck + affected suites).
• Instructions current — AGENTS.md comment rule + docs prose-lint updated.