fix(tests): drain base-red cluster from 2026-08-23 merges (#9985)

Drain the unit-shard reds the 2026-08-23 merge wave left on
release/v3.8.50, each discriminated as stale-test (contract moved
intentionally, test aligned) vs real bug (fixed in code/messages):

1. check-deps 6A.8 allowlist — #11224 added @testing-library/dom and
   @testing-library/user-event to package.json without the gate
   allowlist. Both are legitimate: @testing-library/dom is a required
   peer of @testing-library/react v16, and user-event is the official
   companion for UI tests. Fix: allowlist entries with a justification
   note referencing #11224/#9985.

2. search-route 400-vs-fallback — #11097 intentionally changed the
   zero-credential /v1/search contract: instead of returning 400 it
   promotes the fallback-only duckduckgo-free provider so out-of-the-box
   search works. The test pinned the OLD 400 contract. Fix (contract
   alignment): the test now pins the new fallback contract — 200,
   provider duckduckgo-free, DuckDuckGo lite endpoint called, results
   parsed from lite HTML.

3. codex catalog token limits (4 named reds + 2 sibling sweeps) —
   #11179 raised GPT_5_6_CODEX_CAPABILITIES from the 272K pricing tier
   to the real usable 872K window (live evidence: 390K served past
   272K with HTTP 200) and updated codex-gpt56-catalog.test.ts but
   missed the sibling pins. Stale tests aligned: models-catalog-combo-
   metadata (max_input_tokens now clamps to min(872000, 500000 override)
   = 500000), vscode-token-routes x3 (872000), and two more found in the
   sibling sweep: vscode-token-routes-gpt56 and provider-models-route-
   codex (conservative merge semantics unchanged: pinned 872000 < live
   999999 still wins).

4. CLI catalog counts (3 reds) — #11166 added prime-agent (agent
   category) without the cardinality pins: EXPECTED_AGENT_COUNT 8->9,
   total 34->35, D15 agent list + prime-agent, cli-tools-schema id list.
   Also added the missing English/Vietnamese cliTools descriptions for
   prime-agent (cli-catalog-display-contract) and corrected the stale
   CLI-TOOLS.md agent count (8->9).

5. setup-qwen container guard — since #10057 the container guard exits 2
   on ephemeral runtimes; the two tests exercising the merge/write path
   were environment-sensitive (red on container devboxes). Fix: pass
   allowContainerWrite so the tests are hermetic everywhere; the guard
   keeps its own dedicated coverage.

6. i18n health verdict namespace (real bug, fixed in messages) — #11224
   added the verdict/diagnostics strings to the `sidebar` namespace but
   health/page.tsx reads them via useTranslations("health"), so the page
   rendered raw keys in every locale and the "direct translation calls
   have English messages" gate went red. Fix: keys moved sidebar->health
   in en.json + vi.json (the only locales that had them), plus
   health.healthSubtitle added. The sidebar never referenced them
   (verified: no usage), and sidebar.healthSubtitle (its real sidebar
   key) is untouched.

7. i18n pt-BR drift (22 keys) — the 08-23 wave (#11224/#11228/#11215/
   #11204/#11195) added English keys never translated: common.batch*,
   endpoint.*, cliCommon.concept.acp.warning, resilienceConnections.*,
   plus the moved health.* keys and the prime-agent cliTools
   description. Fix: pt-BR translations added — 0 missing keys vs en;
   vi strict parity re-verified (0 missing, 0 extra).

Validation: every touched test file RED->GREEN individually
(node --import tsx/esm --test), typecheck:core clean, docs-counts-sync
soft-pass, cli-i18n gate PASS, 8/8 unit shards re-run on the branch.

Refs #9985

docs/reference/CLI-TOOLS.md

@@ -1,19 +1,19 @@
 ---
 title: "CLI Tools — OmniRoute"
 version: 3.8.50
-lastUpdated: 2026-08-18
+lastUpdated: 2026-08-23
 ---
 
 # CLI Tools — OmniRoute
 
-Last updated: 2026-08-18
+Last updated: 2026-08-23
 
 OmniRoute integrates with three categories of CLI tools spread across three dedicated dashboard pages:
 
 | Page           | Route                   | Concept                                                                   | Count        |
 | -------------- | ----------------------- | ------------------------------------------------------------------------- | ------------ |
 | **CLI Code's** | `/dashboard/cli-code`   | Coding tools you point at OmniRoute (Client → CLI → OmniRoute → Provider) | 26           |
-| **CLI Agents** | `/dashboard/cli-agents` | Autonomous agents you point at OmniRoute (same flow, broader scope)       | 8            |
+| **CLI Agents** | `/dashboard/cli-agents` | Autonomous agents you point at OmniRoute (same flow, broader scope)       | 9            |
 | **ACP Agents** | `/dashboard/acp-agents` | CLIs that OmniRoute spawns as backend via stdio/ACP (reverse flow)        | see registry |
 
 Legacy routes redirect via 308: `/dashboard/cli-tools` → `/dashboard/cli-code`, `/dashboard/agents` → `/dashboard/acp-agents`.