feat(vision): honor current preset routes

[huangzesen]

Summary

• make direct vision follow the current preset's exact route: provider, model, endpoint, explicit credential, supported headers, and effective wire
• fail closed to vision(action="manual") when the current route is unsupported or lacks an explicit current identity; never switch provider/model/account, use a default OAuth identity, or fall through to SDK environment credentials
• support the current OpenAI/Anthropic/Gemini/MiMo/Codex routes, compatible aliases, and explicit hidden local route; remove the retired automatic MiniMax/Zhipu vision-service implementations
• ship provider-neutral read-only manual guidance and sanitized identity/error surfaces
• document the product rule that missing/blank/whitespace/auto wire selection is automatic (official Responses only when explicitly preferred with no custom base; otherwise Chat), while unknown nonblank/non-string selectors remain manual-only

Supersedes #957.

Companion gate

This is the kernel companion to TUI PR #664:

• feat(presets): map vision support across built-ins lingtai#664

The TUI and kernel PRs describe one product contract and should be reviewed/landed together. This PR does not authorize a live refresh, install, release, or deployment.

Validation

Latest-main base at push: 2d415fda9c3ef48c5c4fed61dfacf87fb632d6e0 (#962 + #963).

• 151 passed — vision capability + preset manifest + package/manual + agent capability integration
• 78 passed — vision services and canonical wire behavior
• 160 passed — tool glossary
• 20 passed — latest-main shell and Task Card handoff compatibility
• Ruff and Python compile checks pass
• vision manual validator and both Anatomy relationship checks pass
• fresh-interpreter sentries cover OpenAI/Anthropic/Gemini/MiMo factory + direct-constructor rejection of missing/blank/non-string credentials before provider/SDK import, with valid credentials preserved byte-for-byte
• staged candidate was clean: 22 paths, 0 unstaged, 0 untracked, 0 unmerged; exact deletes are only the retired services/vision/minimax.py and services/vision/zhipu.py

External gate: an isolated wheel build would download setuptools>=68, so no network/install was performed. Package-data/resource coverage is verified statically and by tests.