fix(catalog): keep live pins when the supplied baseline omits the slug

[luvs01]

Summary

Follow-up for a CodeRabbit fix that missed the #4941 merge window: the review thread was resolved against commit 89fcc5de6, but the PR merged at the earlier head 84014036d, so the fix never reached dev. This replays exactly that change onto current dev.

When applyMultiAgentMode merges a supplied nativeDefaults baseline, a native row whose slug is absent from the baseline fell back to the bundled UPSTREAM_NATIVE_ENTRIES snapshot — so a bundled "v2" pin overwrote a live "v1" pin the baseline never mentioned. The fallback now only applies when no baseline was supplied at all (options.nativeDefaults === undefined); an explicit baseline is authoritative for exactly the slugs it contains, and omitted slugs keep their live pins.

Regression test: mode default keeps a live pin the supplied baseline does not mention covers a baseline that lists only gpt-5.5, asserting the live gpt-5.6-sol "v1" pin survives.

Verification

• bun test tests/codex-integration/codex-v2-gate.test.ts — 131 pass / 1 pre-existing flaky timeout (mode-only switches translate the limit..., passes in isolation at 4.75s vs its 5s bound; unrelated management-API surface).
• Base: origin/dev 88249ed75, 0 behind.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.
• I pushed my PR to the latest dev commit.
• I resolved all correct Codex and CodeRabbit findings.
• My PR is ready for review.

[coderabbitai]

Warning

Review limit reached

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 2b6d0dd7-f789-4434-a592-c2feb459c465

📥 Commits

Reviewing files that changed from the base of the PR and between baae905 and 13d4a7b.

📒 Files selected for processing (2)

• src/codex/catalog/parsing.ts
• tests/codex-integration/codex-v2-gate.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Merging with macOS legs outstanding, and recording why rather than leaving it implicit.

At this exact head the full Linux suite (test 1/4 through 4/4), gates, storage policy, enforce-target, the docs build, and the keyring and npm-global smokes are green. The macOS legs are queued behind a saturated hosted-runner pool shared by several concurrent lanes, and the sharded macOS legs are separately known to go silent mid-suite and be cancelled at their job budget — a long-standing defect recorded with six occurrences in #4956, including two from the 2.58.0 round that were previously written off as capacity.

This change is platform-neutral, so waiting on a queue that is both saturated and known-unreliable would delay the work without adding information. The evidence that governs the release is not per-PR macOS legs; it is the full-platform lane=all dispatch at the frozen release candidate, which is held until #4956 has a named cause. Nothing is promoted on the strength of this merge.

Stating the boundary plainly: this is merged on Linux, gates and cross-platform smoke evidence at its exact head, with macOS coverage deferred to the candidate run rather than claimed here.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu