feat: v3.6.4 — Combo Builder v2, Composite Tiers, P2C Credentials, Observability Layer

## New Features
- Combo Builder v2 wizard UI (multi-stage: Basics → Steps → Strategy → Review)
- Combo Step Architecture Schema v2 (ComboModelStep, ComboRefStep, pinned accounts)
- Composite Tiers system for tiered model routing with fallback chains
- Model Capabilities Registry (unified resolver merging specs + registry + synced data)
- Observability module (buildHealthPayload, buildTelemetryPayload, buildSessionsSummary)
- Session & Quota Monitor panels on Health dashboard
- Combo Health per-target analytics via resolveNestedComboTargets()
- Combo Builder Options API (GET /api/combos/builder/options)

## Performance
- Middleware lazy loading (apiAuth, db/settings, modelSyncScheduler)
- E2E auth bypass mode (NEXT_PUBLIC_OMNIROUTE_E2E_MODE)

## Bug Fixes
- P2C credential selection with quota headroom awareness
- Fixed-account combo steps bypass model cooldowns/circuit breakers
- Combo metrics per-target tracking (byTarget with executionKey)
- Call logs schema expansion (7 new columns + composite index)
- Quota monitor lifecycle enrichment (status, snapshots, summary)
- Codex quota fetcher hardening

## Maintenance
- DB migration 021 (combo_call_log_targets)
- Combo CRUD normalization on read
- Playwright config + build script improvements
- OpenAPI spec version sync to 3.6.4

## Tests
- 16 new test suites + 12 existing test updates
- 86 files changed, +8318 -1378 lines

src/shared/utils/machineId.ts

@@ -1,5 +1,5 @@
 import { execSync, execFileSync } from "child_process";
-import { existsSync, readFileSync } from "fs";
+import { existsSync } from "fs";
 
 /**
  * Get raw machine ID using OS-specific methods.
@@ -58,9 +58,16 @@ function getMachineIdRaw(): string {
   // Strategy 3: Linux — read machine-id files directly (no `head` or pipe)
   try {
     for (const filePath of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
-      if (existsSync(filePath)) {
-        const content = readFileSync(filePath, "utf8").trim().toLowerCase();
+      try {
+        const content = execFileSync("cat", [filePath], {
+          encoding: "utf8",
+          timeout: 5000,
+        })
+          .trim()
+          .toLowerCase();
         if (content.length > 8) return content;
+      } catch {
+        // Try the next candidate file
       }
     }
   } catch {