fix: preserve Ollama Cloud aliases without auth

[Astro-Han]

Summary

• Preserve exact Ollama Cloud :cloud aliases across local-daemon discovery, persisted model state, Desktop selection, Headless host-cell routing, and both turns of an agent tool-call loop.
• Keep the existing complex local Ollama model-ID regression while adding an independent qwen3.5:cloud contract.
• Stop injecting the dummy Authorization: Bearer ollama header into no-auth local daemon requests.

Why

Refs #860.

Ollama Cloud models run through the existing signed-in local Ollama daemon and retain the existing persisted ollama provider ID. Ollama's local API requires no request authentication; the daemon owns its ollama.com sign-in state. The previous OpenAI-compatible adapter fallback injected a dummy bearer value even though ollama is registry-declared no-auth. Removing that single-purpose fallback restores the no-auth invariant without adding a Cloud provider, key, endpoint, or parallel runtime path.

Scope

• No new persisted provider ID, hosted Ollama API preset, Cloud credential field, or migration.
• No Phase 7 conformance-matrix work.
• No branding changes: the existing verified Ollama SVG continues through the shared ProviderLogo path, and the existing provenance/notice contract remains green.

Verification

• npm run typecheck — passed for every workspace.
• npm --workspace @maka/core test — passed.
• npm --workspace @maka/storage test — passed; includes exact local/Cloud discovery snapshot and selected-default persistence.
• npm --workspace @maka/runtime test — passed; includes separate complex local-ID and qwen3.5:cloud discovery/two-stage tool-call cases, with no Authorization header on discovery or chat.
• npm --workspace @maka/headless test — passed; includes separate complex local-ID and qwen3.5:cloud no-auth host-cell cases.
• npm --workspace @maka/desktop test — passed; includes exact local/Cloud catalog distinction and unchanged Cloud selection, plus the existing Ollama SVG/provenance/notice/shared-render-path contract.
• npm run check:stale — passed.
• git diff --check origin/main...HEAD — passed.
• Independent reviewer: 0 P0–P3.
• Live signed-in smoke was not run because the local environment has no Ollama CLI. This is non-blocking: no user models, tokens, or raw daemon responses were read or recorded, and deterministic local HTTP fixtures cover the protocol contract.
• Local Desktop E2E was deferred to CI as allowed by Issue feat(providers): support common providers from models.dev #860; the CI E2E job remains a merge gate.

Impact

Existing Ollama connections keep the same provider ID, local daemon endpoint, model discovery, selection, and runtime path. Exact local and Cloud model IDs remain unchanged. Local daemon requests no longer carry a dummy Authorization header. No migration, documentation, release-note, or user-visible UI change is required.

Reviewer notes

Please focus on the local-daemon ownership boundary: Maka supplies no Cloud key or hosted endpoint, while a signed-in Ollama daemon handles Cloud access. The runtime fixture deliberately distinguishes qwen3.5 from qwen3.5:cloud, and the pre-existing hf.co/bartowski/Qwen2.5-Coder-7B-Instruct-GGUF:Q4_K_M case remains independently covered.

Official contract references:

• https://docs.ollama.com/api/authentication
• https://docs.ollama.com/api/tags
• https://docs.ollama.com/api/chat
• https://docs.ollama.com/cloud

Ready for review

• Verification is complete and the results above are current
• Impact, compatibility, migration, documentation, and release-note needs are addressed
• User-visible UI/UX changes include visual evidence, or Verification explains why it is not applicable