[Astro-Han]

Summary

Part of #860. Adds the Alibaba Coding Plan subscription cohort as two independent, persisted provider ids:

• alibaba-coding-plan-cn — China (https://coding.dashscope.aliyuncs.com/v1, category: 'domestic')
• alibaba-coding-plan — global (https://coding-intl.dashscope.aliyuncs.com/v1, category: 'overseas')

Both are subscription plans distinct from the existing alibaba direct API path: separate endpoint, plan-only sk-sp- key, and isolated billing. They share an identical tool-calling model snapshot. Following the registry-driven design, each is a single providerRegistry entry (catalogGroup: 'plans', catalogBadge: 'Plan', protocol: 'openai', runtimeAdapter: openai-compatible/provider, modelDiscovery: { kind: 'fallback' }, authKind: 'api_key') inserted adjacent to alibaba at readyOrder/catalogOrder 41.1/41.2. Model metadata is regenerated from models.dev into the vendored snapshot; fallbackModels is a hard-coded, guard-asserted allowlist of tool-calling text models only.

fallbackModels (identical for both regions, from the vendored models.dev snapshot):
qwen3.7-plus, qwen3.7-max, qwen3.6-plus, qwen3.6-flash, qwen3.5-plus, qwen3-max-2026-01-23, qwen3-coder-next, qwen3-coder-plus, glm-5, glm-4.7, kimi-k2.5, MiniMax-M2.5.

Interactive-only license (mirrors #914 Tencent Token Plan): Coding Plan is licensed for interactive coding/agent tools only; API automation is prohibited. Neither id is added to headless provider-env.ts, and headless boundary tests assert credentials resolve to '' even when a plan env var and a credentials file are both present.

Brand reuses the already-vendored alibabacloud.svg via a fall-through case (no new SVG, no THIRD_PARTY_LICENSES change). No reasoning wiring was needed: the models expose no reasoning-effort variants and the auto-generated conformance matrix reports no gaps for either id (pure openai-compatible + fallback discovery).

Lifecycle note: Coding Plan is in a shrinking lifecycle phase (Lite tier withdrawn from sale; Alibaba is positioning Token Plan as the successor). The Pro tier remains on sale and usable today, so this slice ships without issue; the sibling Token Plan cohort is tracked separately under #860.

Verification

Run from the worktree; all green:

• npm run typecheck — pass (all workspaces; required rebuilding @maka/core dist so the derived ProviderType union propagates)
• npm run sync:model-metadata — regenerated; only the two new providers added to the vendored snapshot (unrelated live models.dev drift in other providers was excluded to keep the slice minimal)
• npm run test:scripts — 108 pass (includes sync-model-metadata.test.mjs with the two new ids in PROVIDER_IDS)
• npm --workspace @maka/core test — 1040 pass
• npm --workspace @maka/runtime test — 1972 pass, 0 fail (auto-generated conformance matrix + gap report cover both new ids)
• npm --workspace @maka/storage test — 282 pass
• npm --workspace @maka/headless test — 1008 pass (interactive-only boundary assertions)
• npm --workspace maka-agent test — 407 pass
• npm --workspace @maka/desktop test — 2556 pass (brand governance contract)
• npm run check:stale — dist fresh (rebuilt desktop renderer)
• git diff --check — clean

No per-provider add-flow E2E added (per repo AGENTS.md; providers are covered by the representative journeys and registry contract tests).

Live smoke not run: maintainers do not have a Coding Plan subscription key, so no sanitized live smoke was executed against the real endpoint. Coverage is entirely deterministic — the two-stage fake-backend tool-call wire and fallback-discovery assertions in the conformance matrix, plus the registry/catalog/auth/storage/cli contract tests. Any real-endpoint behavior issue will be fixed on user feedback.