fix(collector): price Devin models by their dotted or OpenRouter name, release 0.5.2

[cgaravitoq]

What

Devin rows for deepseek-v4-1-flash, glm-5-3-flash, swe-2 and swe-2-max were stored with cost_usd 0. Measured in D1 on 2026-10-08: about 1.41 billion deepseek-v4-1-flash tokens across the Mac mini and the MacBook Air at $0, plus glm-5-3-flash and swe-2 on the Air.

Two things stacked up:

• litellmModel only turned gpt-X-Y- into gpt-X.Y-, while Devin dashes every minor version.
• LiteLLM has no bare deepseek-v4.1-flash or glm-5.3-flash key. It lists them only by reseller (openrouter/deepseek/deepseek-v4.1-flash, azure_ai/deepseek-v4.1-flash, prism/..., zai/glm-5.3-flash), and the resellers disagree by up to 7x.

Change

• priceFor in pricing.ts tries the bare key, then the openrouter/<vendor>/<model> listing, since OpenRouter passes the vendor's list price through.
• A Devin name keeps its dashes unless only the dotted form has a price. claude-fable-5-1 stays as it is, gpt-5-6-sol still becomes gpt-5.6-sol, and deepseek-v4-1-flash becomes the deepseek-v4.1-flash that pi and opencode already report.
• Antigravity tries the OpenRouter listing after gemini/.
• swe-2 and swe-2-max have no public price anywhere and keep their warning.
• bun audit --production failed on main after four new advisories. bun audit fix clears three of them within range. sharp is pinned exactly by miniflare, even in its latest release, so it joins undici in the miniflare override at the 0.35.5 patch.
• The collector is released as 0.5.2.

Why now

The collector reports a 14-day window, and a day that leaves it is never repriced. The Air's $0 deepseek-v4-1-flash rows of 2026-09-27 leave the window on 2026-10-11, so both machines need 0.5.2 before then.

Verification

• New specs in mapping.spec.ts and pricing.spec.ts cover the four measured Devin names, the Claude regression, the OpenRouter-only antigravity model, and the reseller that must not win.
• A dry collect on the Mac mini with the real LiteLLM cache prices the Devin rows: deepseek-v4.1-flash on 2026-09-29 comes to $8.37, and the only warning left is devin: no price for swe-2-max.
• bun install --frozen-lockfile, format, lint:slop, check-types, test, test:dependency-policy, test:package, audit:production, build and wrangler deploy --dry-run all pass locally.