[Astro-Han]

Summary

• Add StepFun Step Plan China as the independent persisted provider stepfun-step-plan, with its dedicated endpoint, credential namespace, exact current model snapshot, and honest fallback discovery.
• Wire the provider through runtime reasoning/tool-call replay, headless, storage, CLI, and Desktop while reusing the existing governed StepFun brand asset.
• Add deterministic two-stage tool-call and cross-host contract coverage without contacting the real subscription service.

Why

Refs #860. StepFun Step Plan is a separate China subscription product with its own endpoint, key, account balance, and supported model set. It must not be conflated with StepFun China direct API, StepFun Global direct API, or a future Global Step Plan identity.

Scope

This PR only adds StepFun Step Plan China under stepfun-step-plan. It does not add or modify China direct stepfun, Global direct stepfun-ai, Global Step Plan, other providers, or Phase 7 work. The provider uses snapshot fallback because the public Step Plan contract does not promise a /models endpoint.

Verification

• npm test — passed across Core, Storage, Runtime, Computer Use, Headless, CLI, UI, and Desktop.
• npm run typecheck — passed for every workspace.
• npm run build — passed, including the renderer build and byte-identical third-party notice check.
• node --test scripts/sync-model-metadata.test.mjs — 15/15 passed.
• npm run check:stale — passed (dist is fresh).
• git diff --check origin/main...HEAD — passed.
• Existing StepFun SVG governance — passed; SHA-256 remains f46fbd1eee00a3dc7874395484bcc3e25a803e9eb4b79f07b7eec377a1e2f25c, and neither the SVG nor THIRD_PARTY_LICENSES.txt changed.
• Named reviewer on the final rebased SHA — 0 P0–P3 findings.
• Local Desktop E2E was not run, as allowed for this slice; the deterministic fake-backend provider journey is covered in the existing Playwright suite and CI E2E is a merge gate. Static screenshots are not useful for this registry/wiring change; Desktop unit/E2E contracts instead verify catalog/detail route through the same ProviderAssetMask and currentColor brand path.
• No live StepFun smoke was run because no safe subscription credential was available; no secret or raw provider response was recorded.

Impact

Users with a StepFun Step Plan China subscription can configure its independent key and endpoint and select its officially supported agent models across Desktop and CLI/headless hosts. Existing provider IDs and credentials are unchanged; no migration is required.

Reviewer notes

Review the provider registry as the single owner of identity, ordering, endpoint, auth, discovery, and model snapshot. The deterministic runtime test locks reasoning replay plus the assistant tool-call/tool-result continuation without relying on undocumented /models behavior. The Desktop path deliberately reuses the existing byte-identical StepFun SVG and notice provenance.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable