fix(claude): stop restoring stale local env after external provider switch

[yan-6]

Summary

• The __wesight_managed.claudeCode.originalEnv snapshot in ~/.claude/settings.json is captured once ("first seen wins") and never updated.
• When the local Claude Code provider is changed outside WeSight — e.g. by a config switcher (cc-switch) that rewrites settings.json while preserving the __wesight_managed block — restarting WeSight or switching the config source to "local CLI config" (本机配置) restores the outdated snapshot, silently reverting the user's provider/model to a previously used one.
• Fix: record the overlay env WeSight last wrote as managedEnv in the managed metadata. On merge/cleanup, if the live env no longer matches that overlay, treat it as an external change: keep the live values and refresh the snapshot instead of restoring the stale one. Legacy metadata without managedEnv keeps the previous behavior.

Reproduction

1. Configure a local Claude Code provider A (e.g. via a config switcher), let WeSight manage settings once (WeSight model mode), then switch back to local config — snapshot now contains A.
2. Switch the local provider to B outside WeSight (config switcher rewrites settings.json, preserving __wesight_managed with snapshot A).
3. Restart WeSight with config source = local CLI config → removeWesightManagedClaudeSettings restores provider A into env; the UI and launched Claude Code use A instead of B.

Test plan

• npx vitest run src/main/libs/externalAgentConfigSync.test.ts — 27/27 pass (4 new cases: managedEnv recording, external switch preserved on cleanup, snapshot refresh on next merge, legacy metadata backward compatibility)
• Full npx vitest run — no new failures (1 pre-existing environment-dependent failure in externalAgentEnvironment.test.ts, also fails on clean main)
• npx tsc --noEmit clean; npx eslint on changed files clean
• Manual: switch local provider via an external tool, restart WeSight with 本机配置, verify the current provider is kept

[vercel]

@yanyanyanyan0918-cmyk is attempting to deploy a commit to the canghe's projects Team on Vercel.

A member of the Team first needs to authorize it.

[yan-6]

Synced with main (c913cd9)

Upstream c913cd9 (feat(models): add openlux provider for v1.0.9) landed on main. Merged it in and checked for file-level overlap with this PR: none — this branch and the upstream commit touch disjoint files, so there was no risk of two diffs landing in one function.

Verified after the sync that this PR's own diff is unchanged (same files, same +/- counts, nothing pulled in from the merge), it is now 0 behind main, and CI is green on the merge commit: test, verify, lint, build-main, CodeQL, dependency-audit, secrets-scan, skills-audit all pass. The only red check is Vercel (Authorization required to deploy) — fork PRs can't reach deploy secrets, environmental and unrelated to the code.

No code changes in this update; updated_at is also reset, which pushes back the 30-day stale-bot countdown (area:* labels are not in exempt-pr-labels). Still ready for review.