Document catalog credential-removal convergence as rebuild-only

[TheGreatAxios]

Summary

Credential-removal convergence for the model catalog is rebuild-only, documented at the reconcile funnel (mergeOAuthCatalog in src/config/index.ts) with a regression test pinning the behavior.

Decision: document restart-only, not a disabled flag

Disable proved structurally wrong here, so per the brief I took the document path:

• No disabled state exists on ProviderCatalogEntry, ProviderSettings, or the ModelCatalogOption rows the picker consumes.
• Adding one end-to-end is invasive: a new in-memory flag plus persistence stripping (it must never leak into settings.json via providerCatalogToSettings), plus threading through the catalog-to-picker mapping and the product-host boundary — with no removal event to drive it. There is no logout/disconnect surface and no auth-store watcher; refresh runs on connect, prefetch, and startup, so even a perfect flag would only converge on the next rebuild.
• The disable-not-delete rationale already holds structurally: every rebuild re-projects settings-file providers verbatim, so manual rows are never deleted, and OAuth rows are ephemeral projections stripped before persistence, so dropping one on logout loses nothing and re-auth restores it on the next rebuild.

Operational model: removal takes effect on the next rebuild (restart, provider connect, or model prefetch), not live. No behavior changed; no docs touched, so PR #265 doc accuracy is intact.

Verification

• bun test src/config.test.ts -t "catalog credential-removal convergence" — 2 pass, 0 fail (exit 0)
• bun run check (lint + typecheck + build + projects-dir guard + full suite) — exit 0; 7133 pass, 0 fail across 488 files

Fixes CL-5446

[linear-code]

CL-5446

[TheGreatAxios]

Audit: NEEDS-WORK (overbroad "never deleted") + merge note

Finding: "Manual rows are never deleted — settings-file providers are re-projected verbatim" overstates the invariant: #973's bare-row dedupe in this same function (mergeOAuthCatalog) drops a legacy bare codex/xai settings row once that family has a live credential-backed profile. The comment should carve out that exception — settings-file rows are re-projected verbatim except the bare-row dedupe, i.e. derived credential rows win over the legacy bare settings row. I will push that reword to this branch.

Merge note: this PR and #973 touch adjacent hunks of src/config/index.ts around mergeOAuthCatalog (this one adds the comment block above it; #973 reworks its signature and body). Land #973 first, then rebase this branch before merge.