Contributor key contracts v2: one model for all of an owner's keys of a provider #5633

The contributor key contracts (specs/automation/queen-contributor-keys.t27, specs/automation/hive-contributor-keys.t27, #5472/#5473) give the owner no way to change the model their keys run. On 2026-10-02 the owner asked for one switch per provider in https://app.t27.ai/game/account and for NVIDIA to move to z-ai/glm-5.3.

v2 of both contracts:

• Queen: an owner may switch every key of a provider only after one of those keys made the model call a tool. A bounded number of keys is tried (MODEL_CHECK_ATTEMPTS). The model name is bounded (MODEL_LIMIT). PROBE_TIMEOUT_MS goes from 15 s to 90 s: z-ai/glm-5.3 on NVIDIA answered in 20–46 s, glm-4.5-flash on Z.ai in up to 87 s.
• Render: only {provider, model} crosses the model boundary. PROXY_TIMEOUT_MS goes from 45 s to 200 s, which outlasts the Queen's check (2 × 90 s).

Hosts are already on v2: gHashTag/BrowserOS#524 and gHashTag/999-multibots-telegraf#3429. This issue brings the canonical copies here, byte for byte, with seals and negative controls.