feat(deepseek): ship the canonical V4.1 Flash id and let the Ark rows be configured

[huangruiteng]

Goal And Delivered Outcome

• Outcome basis / optional anchor: no public issue. The maintainer asked in
  session for the DeepSeek-V4.1-Flash generation to be configurable on the
  surfaces that name a managed model.
• Goal/source and gap: the shipped managed execution profile named
  deepseek-v4-flash, the retired spelling of the same DeepSeek-V4.1-Flash
  generation whose current vendor id is deepseek-flash. The Ark rows of the
  provider-routing catalog were pinned to one GA literal
  (deepseek-v4-flash-ga-260731) and labelled "V4 Flash", so an operator could
  not adopt a newer upstream id without a source change, and the App catalog
  and the CPA runtime config could drift apart. The steward-executor model field
  offered only Codex model suggestions.
• Observable before → after, with the validation row that proves it: the managed
  profile readback moves from deepseek-v4-flash@high to deepseek-flash@high
  (first unit row); an operator who configures a newer upstream id gets that
  id's own Ark row and a V4.1 Flash label (both integration rows); a host that
  still pins the retired spelling keeps resolving it through LOOPX_TURN_MODEL
  / DSH_MODEL, unchanged.
• Issue/task and intended base: no public issue. Intended base: main.

Author Declaration

• Written by: model_agent — a Codex desktop agent running DeepSeek-V4.1-Flash
  through the DeepSeek API, on the maintainer's machine, from the maintainer's
  in-session request.

Implemented against

• Specification and revision: no written specification; the maintainer's
  in-session request is the basis. The statements this change keeps consistent
  with that request are the execution-profile table in
  docs/reference/protocols/loopx-turn-v0.md, the managed-profile statements in
  docs/reference/operator-model-credential.md and
  docs/architecture/rfcs/harness-selection-dsh-pi-v0.md, and the model table in
  packages/loopx-codex-provider-routing/RUNBOOK.md.
• Criteria:

Criterion (spec clause)	Disposition	Symbol / path	Test or command
The shipped managed model default names the current vendor id	implemented	MANAGED_MODEL_DEFAULT in loopx/control_plane/turn_driver/execution_profile.py	pytest tests/test_turn_managed_executor_binding.py tests/test_manager_channel_binding.py
The retired spelling stays available as an explicit override	implemented	MODEL_ENV_VAR / LEGACY_MODEL_ENV_VAR resolution, unchanged	override cases in the same two files
Ark catalog rows follow the operator's configured ids	implemented	ark_selectors(), AppCatalog.SELECTORS in operator_catalog.py	python packages/loopx-codex-provider-routing/smoke/operator_smoke.py
One row reads as one generation on every surface	implemented	operator_runtime.runtime_config reusing ARK_FLASH_LABEL / ARK_PRO_LABEL	test_runtime_config_renders_the_same_generation_label
The steward-executor model field offers the DeepSeek ids	implemented	apps/presentation/dashboard/src/features/personal-workspace/capability-configuration-fields.tsx	node --experimental-strip-types apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs
Current-state docs name the shipped id	implemented	docs/reference/**, docs/integrations/deepseek-harness-connector.md, loopx/dsh_goal_mode/README.md; both RFCs carry a dated revision note and keep their original dated record	loopx check --scan-path . and diff review

• Self-check before submission: read the whole diff; confirmed the module-level
  SELECTORS view still describes a stock configuration while an AppCatalog
  instance projects the ids its own operator configured; ran every check listed
  below on the tested revision. Deliberately not run: a live bounded Turn
  against a vendor endpoint (the DeepSeek Harness SDK is absent from the
  validation environment) and the dashboard bundle build, so the suggestion list
  is covered by its source-level contract smoke only.

Scope And Continuation

• Completed scope and remaining work: the shipped id, the configurable Ark rows
  and their labels are consistent across the managed profile, the
  provider-routing catalog, the runtime config, the dashboard field and the
  current-state docs. A separate, non-repository adjustment to one personal
  Codex App install is not part of this PR.
• Slice boundary / successor: complete within this scope; no successor.

Validation

• Tested revision: 09933b4
• Run state: finished
• Input classes: synthetic

Check kind	Result	Public-safe evidence / limitation
unit	passed	uv run --extra test python -m pytest tests/capabilities tests/test_manager_channel_binding.py tests/test_turn_managed_executor_binding.py tests/test_chat_machine_configuration_api.py tests/test_dsh_goal_mode.py tests/test_chat_dsh_adapter.py tests/test_chat_manager_context.py tests/test_chat_executor_profile.py -q → 2248 passed, 42 skipped
integration	passed	python packages/loopx-codex-provider-routing/smoke/operator_smoke.py → Ran 21 tests, OK (offline operator: three-account ring, catalog rows, runtime config, rollback)
integration	passed	python packages/loopx-codex-provider-routing/smoke/codex_provider_routing_smoke.py → extension smoke passed
unit	passed	node --no-warnings --experimental-strip-types apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs → passed
static	passed	uv run --extra test ruff check packages/loopx-codex-provider-routing/src/loopx_codex_provider_routing loopx/control_plane/turn_driver/execution_profile.py; git diff --check
static	passed	loopx check --scan-path . → errors=0, warnings=0; public boundary scan clean over 4450 files
real_entrypoint	not_run	No live bounded Turn against a vendor endpoint was launched from this environment; whether the canonical id resolves is the operator's endpoint configuration. A host that pins the retired spelling is unaffected because the override path is unchanged.

• Coverage and gaps: the changed default is covered inside the repository end to
  end — profile resolution, channel binding, machine configuration and the
  capability UI contract — and the provider-routing package's offline smoke
  covers catalog generation, the rendered runtime config and rollback. Not
  covered here: a live managed Turn and the CPA data plane on a real operator
  machine, which need an operator credential and the running service.
  Documentation changes are covered by the static row and the diff review.

Frontend / Visual Evidence

• UI impact: changed
• Before: the steward-executor Model field's suggestion list offered
  gpt-6-sol, gpt-6-luna, gpt-6-astra.
• After: it also offers deepseek-flash and deepseek-v4-pro. The control stays
  free text; no layout, interaction, loading or error state changed.
• States and viewports shown: none. The change is one native <datalist>
  suggestion list, which a static capture cannot show (the popup is browser
  chrome, not page pixels), and the dashboard bundle was not built in the
  validation environment; the field is covered by the source-contract smoke
  above. A built-dashboard capture can be added on request.
• Source data: synthetic
• Attention review: the field gained data, not a control — two more suggestions
  in an existing datalist, no new element and no new failure path, while the
  operator can still type any endpoint id their host serves. Keeping the retired
  spelling out of the suggested set leaves one generation visible instead of
  two.

Type of Change

• New feature
• Bug fix
• Breaking change
• Refactoring (no functional changes)
• Documentation update
• Test update

LoopX Area

• Control plane (goals, todos, quota, scheduler, registry, runtime)
• Benchmark boundary (adapters, runners, verifiers, scoring, evidence)
• Capability or extension (providers, adapters, skills)
• Public docs or presentation surface (README, protocols, dashboard)
• Build, packaging, installer, or CI
• Host or runtime integration

Technical Direction

• Direction / acceptance reference, when applicable:
  DSH / Pi: L1 Observation and Managed Runtime Selection
  — managed host binding and execution profile sections, which carry the dated
  revision note for this change.

Shared-authority RFC fixture impact

• N/A: this PR does not claim progress against the TypeScript control-plane
  migration or the shared Goal Authority RFC.

Boundary Checklist

• Neither the diff nor this PR body/comments/attachments disclose private state, credentials, raw traces or verifier output, internal links, or local machine paths (including .loopx/, .codex/goals/, and live ACTIVE_GOAL_STATE.md).
• I did not duplicate maintainer-owned benchmark work unless a maintainer split out a public issue for it.
• I kept the change scoped to the linked issue/task.
• I completed the visual evidence section for UI changes, or marked UI impact none.
• Every commit includes a DCO Signed-off-by trailer (git commit -s).