feat(models): add Claude Opus 5 and repoint the opus alias to it

Adds `claude-opus-5` to models.json (the SPOT) and moves the `opus` alias
from `claude-opus-4-8` to it. `/v1/models` goes 6 -> 7; OpenClaw picks the
new entry up on the next `ocp update` via scripts/sync-openclaw.mjs.

server.mjs is NOT modified by this PR — models.json is the single source of
truth (ADR 0003) and every consumer (server.mjs MODEL_MAP, setup.mjs,
sync-openclaw.mjs, ocp-connect) derives from it. ocp-connect needs no change
either: its metadata table matches on the `claude-opus` FAMILY prefix, which
`claude-opus-5` hits (the guard added in PR #152 review).

Alignment evidence. The claim "the CLI itself defaults opus -> claude-opus-5"
is verified from the compiled CLI binary 2.1.220 via `strings`, the same
protocol used for #152/#168:

    latest_per_family:{fable:"claude-fable-5",opus:"claude-opus-5",
                       sonnet:"claude-sonnet-5",haiku:"claude-haiku-4-5"}

The same registry entry gives context:{window:1e6,native_1m:true},
max_output_tokens:{default:64000,upper:128000} and pricing:"tier_5_25" --
i.e. identical $5/$25 per MTok to Opus 4.8, so the alias repoint carries no
cost change. Availability confirmed with a live subscription-pool completion
(`claude -p --model claude-opus-5` -> "OK"). This mirrors #168 (sonnet ->
sonnet-5), which established the precedent that following the CLI's own
latest_per_family is the correct default behavior.

contextWindow is deliberately 200000, not the native 1M:

1. MAX_PROMPT_CHARS is a SINGLE GLOBAL budget, not per-model.
   derivePromptCharBudget (lib/prompt.mjs) returns
   `max(floor, max(...contextWindows) * 3)` across ALL entries, so a 1M entry
   would lift the truncation ceiling to 3,000,000 chars for
   claude-haiku-4-5-20251001 as well -- genuinely a 200k-native model --
   turning clean OCP-side truncation into an upstream API rejection.
2. OpenClaw scales its history budget linearly off this value:
   contextWindow * maxHistoryShare * SAFETY_MARGIN (= x0.6), plus an
   oversized-message threshold at x0.5 (compaction-planning, OpenClaw
   2026.7.1). Its own bundled registry hardcodes 200000 for Claude models,
   and the upstream request to raise it to 1M (openclaw#22979) was closed
   "not planned" -- 1M needs a beta header its compaction path omits.

Raising the window for real requires per-model budgets and is ADR-level;
a new regression test pins the invariant so that change has to be deliberate.

Tests: 452 passed, 0 failed. Three mutations verified to bite:
  - revert aliases.opus -> 4-8            => 1 failure (opus-alias SPOT)
  - delete the claude-opus-5 entry        => 2 failures (presence + dangling alias)
  - set its contextWindow to 1000000      => 2 failures (invariant + budget SPOT)

E2E on an isolated port (:3999, prod on :3456 untouched and verified so):
/v1/models returns 7 ids with claude-opus-5 first; a request with
model:"opus" logs event=claude_spawned model=claude-opus-5 tier=opus and
returns a real completion. Derived MAX_PROMPT_CHARS stays 600000.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017gbqUZ8HfBZpjjbzQ85oH8

test-features.mjs

@@ -4067,6 +4067,10 @@ test("models.json aliases.sonnet === 'claude-sonnet-5' (default-request-model SP
   assert.equal(_spotModels.aliases.sonnet, "claude-sonnet-5");
 });
 
+test("models.json aliases.opus === 'claude-opus-5' (opus-alias SPOT)", () => {
+  assert.equal(_spotModels.aliases.opus, "claude-opus-5");
+});
+
 // ── Referential integrity (PR #152 review) ──────────────────────────────────
 // The value-mirror assertions above only prove the alias equals a string literal —
 // they pass even if that literal points at a model that does not exist in
@@ -4080,6 +4084,22 @@ test("models.json: claude-sonnet-5 is present in models[] (the entry this PR add
   assert.ok(_spotModelIds.has("claude-sonnet-5"), "claude-sonnet-5 must exist as a models[].id");
 });
 
+test("models.json: claude-opus-5 is present in models[] (the entry this PR adds)", () => {
+  assert.ok(_spotModelIds.has("claude-opus-5"), "claude-opus-5 must exist as a models[].id");
+});
+
+// The prompt-char budget is GLOBAL (max across every entry × 3 chars/token), not
+// per-model — see lib/prompt.mjs derivePromptCharBudget. A future entry declaring a
+// native 1M window would therefore raise the truncation ceiling for claude-haiku-4-5
+// too (genuinely 200k), turning OCP-side truncation into an upstream API rejection.
+// Adding one is a deliberate ADR-level change; this pins the current invariant.
+test("models.json: every contextWindow is 200000 (global prompt-budget invariant)", () => {
+  for (const m of _spotModels.models) {
+    assert.equal(m.contextWindow, 200000,
+      `${m.id} declares contextWindow=${m.contextWindow}; a non-200k entry re-scales MAX_PROMPT_CHARS for ALL models (see lib/prompt.mjs)`);
+  }
+});
+
 test("models.json: every aliases value resolves to a real models[].id (referential integrity)", () => {
   for (const [name, target] of Object.entries(_spotModels.aliases)) {
     assert.ok(_spotModelIds.has(target), `aliases.${name} -> '${target}' is a dangling alias (no matching models[].id)`);