feat(agent): add astra-only tool-evasion residual

[TheGreatAxios]

Summary

• Branch the served gpt-6-astra cell into its own model family with an evasion-specific tool-discipline residual, composed over the existing GPT narrate-before-tools note. Generic GPT prompts are byte-identical; sol/terra/luna keep riding the generic gpt match.
• Repro-trace classification (CL-9027): EVASION, not threshold-tolerated waste. The 8-turn fixture re-issues the same effective calls with trivial argument deltas (./ prefix, default offset/limit, padding whitespace), so the largest exact tool-fingerprint repeat count is 1 and the shared threshold-3 guard stays silent. Offending pattern: 6x re-read of one file plus 2x re-grep of one pattern — 8 wasted turns, 20020 input tokens re-delivered.

Why this shape: the loop escapes the exact-match guard by varying arguments, so tightening thresholds or normalizing signatures would either miss it or touch the shared guard. The residual forbids the specific variation instead (muse-rule precedent), thresholds stay at the permissive default, and no signature normalization ships in first-party code.

Verification

• Repro-first red: new astra resolver assertions failed pre-fix (family resolved gpt, no astra export); trace-classification pins passed as the artifact.
• bun test src/agent/model-family-policy.test.ts src/subagent/provider-family.test.ts packages/prompt-variance/src/rows.test.ts packages/prompt-variance/src/sizes.test.ts — 54 pass, 0 fail.
• bun test src/agent/prompts.test.ts src/agent/prompt-sizes.test.ts — 52 pass, 0 fail (untouched, insurance).
• bun run typecheck — clean, exit 0 (worktree needed its vendor nested-deps symlink for the pre-existing semver resolution; main tree is clean without it).
• oxfmt --check on all 5 touched files — clean; oxlint — 0 warnings, 0 errors.
• Diff: 5 files, zero under vendor/, no new guard, generic threshold-3 guard untouched.

Fixes CL-9027

[linear-code]

CL-9027