fix(export): preserve Hermes vision capabilities (carry of #3151)

[lidge-jun]

Summary

Maintainer rebase carry of #3151 by @Ingwannu — the original commit cherry-picked onto current dev with author credit preserved. No content change.

Replaces the Hermes string-only model array with the metadata map Hermes uses for custom-provider capability lookup, so supports_vision is emitted from exported catalog modalities: true for rows whose modalities include image, false for an explicit non-empty modality list without image, and no flag at all when modalities are unknown. Stable selector ordering, existing admission references, YAML round-tripping, CLI and management parity, and the no-guessed-video boundary are preserved.

Why a carry branch. #3151's head sat 105 commits behind dev, well past the repository's 10-commit freshness boundary, so its CI run no longer described what would land. A maintainer cannot push to a contributor branch, so the commit is re-applied here. The rebase was clean — one auto-merge in structure/09_client-integrations.md, no conflicts.

On the original's red CI. #3151's ci check was only a rollup reporting platform-macos=failure, and that macOS job's single failure was server local API auth > websocket passthrough refreshes pool auth for each response.create turn (tests/server-auth.test.ts) — a known macOS flake, in websocket auth, nowhere near this diff's Hermes export surface. The author's claim that the failure was pre-existing checked out.

Closes #3146. Supersedes #3151.

Verification

Exact head 298bb8329:

• bun test ./tests/client-export-modality-enum.test.ts ./tests/cli-export-command.test.ts ./tests/client-config-export-new-clients.test.ts ./tests/client-config-new-clients.test.ts ./tests/management-client-config-route.test.ts — 100 pass, 0 fail, 512 expect() calls.
• Cherry-pick applied cleanly onto 0d6424f80; git show --stat confirms the same 7 files, +97/-13 as the original.

Full-suite and typecheck coverage is left to CI on this exact head.

Checklist

• Targets dev
• Author credit preserved via cherry-pick; this is a rebase carry, not a rewrite
• No credential, auth, workflow, or release-automation surface touched — export emits environment references only
• No new dependency; no config or schema change

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T17:15:17.921774Z	298bb83	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.