test(provider): close ZDR review gaps — header authority, doGenerate 422, mock dedup (issue #57)

Review follow-up (code-review axes on 6f24947):

- providerHeadersFor now owns x-cmd-zdr solely via the env opt-in: with
  CMD_ZDR off, any caller-supplied x-cmd-zdr (any casing) is stripped so a
  non-opted-in session never emits the header; with CMD_ZDR=1 the value is
  forced to "1" over any caller-supplied header. Matches the acceptance
  "without CMD_ZDR=1 ... no x-cmd-zdr header is sent on any request".
- New tests: caller-supplied header stripped/forced in both directions;
  422 cmd_zdr_no_providers surfaces as a redacted error via doGenerate
  (previously only doStream was covered).
- mock-cc.ts: extract shared serveError helper, removing the tripled
  *ErrorsLeft nested-ternary + writeHead duplication across the three
  endpoints.

All 10 provider-zdr tests pass; typecheck, contract (no runtime
@opencode-ai/* import), and format checks green. No new dependencies.