fix(protocol): recognize Claude Desktop local-agent requests

[a2662007798-boop]

Claude Desktop can send claude-cli/2.1.299 (external, local-agent, agent-sdk/0.3.299) and a billing block with cc_entrypoint=local-agent. vm2api currently treats that entrypoint alone as OMP, so claude_code_only returns HTTP 403 before checking the existing Claude Code fingerprint.

Limit the change to this classification: let a local-agent request with the matching Desktop UA tokens, desktop_app platform, and a valid desktop version continue through the existing official-client checks. Pass the headers to the same predicate in direct identity classification and admission. All OMP-specific system checks still run. The body-only relay path remains conservative for local-agent.

The existing full header, session, billing-version, tool-shape, quota-probe, and count-token validation logic is unchanged. No helpers are moved and no new modules, dependencies, or settings are introduced.

Validation:

• 318 tests pass across 13 related test files; the new cases cover Desktop admission with relay detection disabled, incomplete markers/headers, mismatched sessions/builds, OMP with Desktop headers, and the existing count-token contract.
• Biome format, source syntax checks, and git diff --check pass.
• An earlier full Windows run had 32 failing files out of 248; all 32 also failed on the unchanged upstream base with the same failure titles. The final narrowed patch needs upstream Ubuntu/Node 22 CI.
• Live verification on the reporter's deployed vm2api has not been performed. Fixtures use synthetic identifiers and contain no credentials or private prompts.