fix(claude): stop restoring stale local env after external provider switch

[yan-6]

Summary

• The __wesight_managed.claudeCode.originalEnv snapshot in ~/.claude/settings.json is captured once ("first seen wins") and never updated.
• When the local Claude Code provider is changed outside WeSight — e.g. by a config switcher (cc-switch) that rewrites settings.json while preserving the __wesight_managed block — restarting WeSight or switching the config source to "local CLI config" (本机配置) restores the outdated snapshot, silently reverting the user's provider/model to a previously used one.
• Fix: record the overlay env WeSight last wrote as managedEnv in the managed metadata. On merge/cleanup, if the live env no longer matches that overlay, treat it as an external change: keep the live values and refresh the snapshot instead of restoring the stale one. Legacy metadata without managedEnv keeps the previous behavior.

Reproduction

1. Configure a local Claude Code provider A (e.g. via a config switcher), let WeSight manage settings once (WeSight model mode), then switch back to local config — snapshot now contains A.
2. Switch the local provider to B outside WeSight (config switcher rewrites settings.json, preserving __wesight_managed with snapshot A).
3. Restart WeSight with config source = local CLI config → removeWesightManagedClaudeSettings restores provider A into env; the UI and launched Claude Code use A instead of B.

Test plan

• npx vitest run src/main/libs/externalAgentConfigSync.test.ts — 27/27 pass (4 new cases: managedEnv recording, external switch preserved on cleanup, snapshot refresh on next merge, legacy metadata backward compatibility)
• Full npx vitest run — no new failures (1 pre-existing environment-dependent failure in externalAgentEnvironment.test.ts, also fails on clean main)
• npx tsc --noEmit clean; npx eslint on changed files clean
• Manual: switch local provider via an external tool, restart WeSight with 本机配置, verify the current provider is kept

[vercel]

@yanyanyanyan0918-cmyk is attempting to deploy a commit to the canghe's projects Team on Vercel.

A member of the Team first needs to authorize it.