feat(find): name the CLI, its harness and model on every find (v2.7.0)

[paulkr]

What

one actions find now says who asked, the same way passthrough already does since v2.6.0, so One's record of agent finds (pica-v2 #993 / #1001, live in prod) can tell CLI finds apart and name the agent and model behind them. Today every CLI find lands with no source, agent or model.

• findActions sends the caller headers. x-one-source: cli, and x-one-agent naming the harness that launched the CLI (claude-code, cursor, …) when one did, from the same callerHeaders() passthrough uses.
• --ai-model is no longer dropped. It was accepted and never sent; it now goes as x-one-agent-model, trimmed, and only when given, since only the agent knows its model. Core bounds it at 128 characters and records it as the find's ai_model.
• Declared, never authenticated: core drops a value it cannot read rather than refusing the find, so a wrong value cannot break one.
• Docs: the --ai-model help, SKILL.md, the guide and the README now say it is recorded with the find, instead of promising documentation tuning that never happened.
• v2.7.0 (package.json and the lockfile's two version fields, by hand).

Tests

• callerHeaders names the model only when given (and trims it); a find sends source, harness and model, or only the source from a plain terminal without --ai-model; other routes still get none.
• src/lib/api-caller-headers.test.ts 10/10; tsc --noEmit clean.
• The six resolveConfig failures in config.test.ts fail on main too (macOS /private/var temp path), unrelated.

🤖 Generated with Claude Code