[Astro-Han]

Summary

• Adds the stable cloudflare-workers-ai provider as a complete registry-driven slice across Core, Runtime, Headless, Storage, CLI, and Desktop.
• Uses the account-scoped Workers AI OpenAI-compatible endpoint, exact @cf/... snapshot model IDs, deterministic two-stage tool/reasoning replay, and a Cloudflare-specific Account ID input.
• Vendors the Lobe Icons Cloudflare SVG byte-for-byte with immutable provenance, SHA-256, license inventory, and renderer notice coverage.

Why

Cloudflare Workers AI is a remaining Phase 3 provider in Refs #860. Its account-scoped endpoint, API token boundary, fallback model catalog, reasoning field, and model IDs need first-class ownership instead of being inferred from generic OpenAI compatibility.

Scope

This PR adds only Cloudflare Workers AI under persisted provider ID cloudflare-workers-ai. It does not add a cloudflare alias or migration, Cloudflare AI Gateway, Workers binding-only deployment, user-hosted endpoints, other providers, or Phase 7 contract work.

Verification

• npm test --workspace=@maka/core — passed.
• npm test --workspace=@maka/runtime — 1,521 passed, 7 skipped, 0 failed.
• npm test --workspace=@maka/desktop — 2,472 passed, 0 failed, including a11y/copy/console checks.
• npm run e2e --workspace=@maka/desktop -- --grep='adds Cloudflare Workers AI' --workers=1 — passed; verifies the provider catalog/detail journey, Cloudflare Account ID input, derived account-scoped URL, exact model ID, token field, and theme-aware asset mask.
• npm run typecheck — all workspaces passed.
• node --test scripts/sync-model-metadata.test.mjs — 20 passed.
• npm run rebuild && npm run check:stale — full workspace build passed and dist is fresh.
• npm run build:renderer --workspace=@maka/desktop — passed; the byte-identical public third-party notice is present.
• Explicit registry assertions passed: ready/catalog orders 28–33 are unique and the Vercel, StepFun Global, and Cloudflare seams coexist.
• Upstream SVG byte comparison passed against Lobe Icons commit e4302041fbb3039608d25f9f618bd462783b875e; SHA-256 is 78f8973dad59f8af7c4042ef6be451d809a4e14bdb2151a75a76b4e0811fd22f.
• git diff --check origin/main...HEAD — passed.
• Named reviewer rereviewed final SHA 94bbacdfb56216ba256980c34814da9aba963bf3 with 0 P0–P3 findings.

No live credential smoke was run because no safe user-owned Cloudflare credential was available. The deterministic local HTTP conformance test verifies both authenticated tool-call turns without logging secrets or raw provider responses. No separate screenshot is attached because the visible change reuses the existing provider form row and governed logo treatment; the serial Playwright journey and computed mask/color contract are the stronger regression evidence.

Impact

Users can configure Cloudflare Workers AI with an Account ID and API token, select exact supported @cf/... models, and run reasoning/tool workflows. Existing persisted provider IDs and connections are unchanged; there is no migration or alias.

Reviewer notes

Cloudflare's current model search API is account-scoped, but its published generated response schema does not provide a stable model-ID contract, so discovery intentionally uses the checked-in models.dev snapshot fallback. The runtime adapter converts the SDK's assistant reasoning_content replay to Cloudflare's documented reasoning field only for this provider.

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable