feat(provider): minimal ZDR passthrough — CMD_ZDR=1 sends x-cmd-zdr on Provider API (issue #57)

When CMD_ZDR=1 is set (the CLI's own opt-in, per the Provider API docs),
every Provider API request (/provider/v1/chat/completions and
/provider/v1/messages, both doStream and doGenerate) carries
x-cmd-zdr: 1; unset/empty/0/other values send no header. The legacy
/alpha/generate transport never sends it, including on the 403
upgrade_required flip retry. A documented 422 cmd_zdr_no_providers flows
through commandCodeErrorMessage -> redactCommandCodeErrorText like any
other API error, observable as a redacted error at the LanguageModel
seam.

Harness hardening:
- env.ts: getCmdZdr() reads CMD_ZDR with exact "1" semantics.
- mock-cc.ts: per-endpoint Retry-After + ErrorCount emulation (fail N
  times then serve SSE) plus documented 403 upgrade_required and 422
  cmd_zdr_no_providers body helpers; shared headersToRecord export.
- provider-upgrade-fallback.test.ts dedupes UPGRADE_BODY onto the shared
  helper.
- New tests/provider-zdr.test.ts (registered in test:unit) covers header
  gating on both endpoints/methods, legacy isolation, the redacted 422,
  the 403-flip legacy-omits-header fact, and 429+Retry-After retry
  recovery on all three endpoints.

No new dependencies; contract test stays green.