fix(provider): align OpenAI fallback model configuration

[jstar0]

Summary

When an unbound API-key provider has no credentials, SkillSpector can construct
an OpenAI fallback client while the graph still assigns model IDs from the
active metadata provider. Analyzers pass those IDs explicitly, so OpenAI-only
semantic scans can send deepseek-ai/deepseek-v4-flash to ChatOpenAI instead
of using the OpenAI default.

Fixes #324.

Changes

• Resolve generated graph model configuration from the provider that matches
  chat-model routing.
• Use OpenAI model defaults only when an unbound API-key provider has no native
  credentials and the OpenAI fallback is configured.
• Preserve explicit slot overrides, configured providers, CLI providers,
  scoped provider bindings, Bedrock native authentication, and no-credential
  static-scan defaults.
• Add regression coverage at the provider/config, real client construction,
  graph context, and MCP scan boundaries.

Risk

The change is limited to generated model defaults. It does not change explicit
model overrides, provider client construction, analyzer interfaces, scan state,
or CLI/MCP response shapes. Bedrock remains on its existing native-auth model
configuration rather than introducing an AWS credential probe during graph
context construction.

Verification

uv run make test-ci
uv run make lint
uv run make format-check
uv run make build

[rng1995]

[Automated SkillSpector Review]

Approved. The generated graph model map now follows the same provider-routing decision as chat-model construction, so an OpenAI credential fallback receives OpenAI model defaults instead of the unconfigured metadata provider's IDs. Explicit bindings, configured/keyed providers, CLI providers, Bedrock native auth, slot overrides, and static-only fallback behavior remain intact. The focused constants, provider, build-context, and MCP tests pass (86 tests).