fix(worker): resolve omitted commands from requested provider

[HsienW]

What & why

Provider only spawn requests could resolve the requested provider correctly while still launching the configured default command. For example, a Codex request with no explicit command could launch claude with Codex specific arguments.

This change derives an omitted command from the explicit provider preset while preserving explicit command precedence and custom provider fallbacks. It also documents the same precedence in the generated hive protocol.

Fixes #462.

This also addresses the provider without command root cause in the spawn request reproduction from #280. The broader startup failure reporting, session readiness, and UI spawn concerns in #280 remain out of scope.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Docs
• Build / CI

Evidence

Before

On main, the same provider only launch probe falls back to the configured claude command even though the requested provider is Codex or OpenCode.

For Codex, this produces the mismatched launch shape:

provider=codex
bin=claude
args=["-a","never","-s","workspace-write"]

provider=opencode
bin=claude
args=[]

After

With this change applied, the same probe derives the executable from the requested provider when no explicit command is supplied.

provider=codex
bin=codex
args=["-a","never","-s","workspace-write"]

provider=opencode
bin=opencode
args=[]

Explicit commands still take precedence, and custom providers continue to use the configured fallback rather than being mapped to a built in provider command.

How I tested it

• OS: Windows 11, PowerShell
• Steps:
  • Ran the same buildWorkerLaunch() PowerShell probe before and after the change to verify provider only command resolution.
  • Ran the issue focused worker launch and command safety coverage.

Validation:

• Issue focused and command safety coverage: 24/24 passing.
• npm run typecheck: passes.
• npm run build: passes.
• git diff --check: passes.
• npm run test:focused: not fully green on Windows. The remaining failures are limited to existing Windows specific cases around symlink permissions, HOME/Temp overrides, and CRLF sensitive source regex assertions. None of those failures exercise the three files changed by this PR, and the issue focused coverage for provider command resolution is fully passing.

I also reviewed the failing test names against this diff and did not find overlap with the worker launch, generated hive protocol, or related regression changes.

Checklist

• Before and after evidence is attached above, under both headings.
• npm run typecheck passes.
• npm run test:focused passes.
• npm run build succeeds.
• This PR is one change. Unrelated fixes belong in their own PR.
• I read the diff myself before opening this, and there is no debug output, commented out code, or unrelated formatting churn in it.
• Any new UI derives from DESIGN.md / tokens.ts with no ad hoc colors, spacing, or fonts. No UI was added in this PR.
• If I added art, it is my own or compatibly licensed and listed in ATTRIBUTION.md. No art was added in this PR.