feat: bump Goose to v1.50.1 and update related configurations

[pikann]

Summary

• Bump the pinned Goose sandbox image from 1.46.0 to 1.50.1 in services/agent-server/Dockerfile — the current latest release, confirmed live via the GitHub/ghcr.io registry APIs (not assumed), with the digest resolved from the registry rather than guessed.
• Rebuild services/agent-runner/data/llm_models.json from a stale ~92-provider generic LiteLLM catalog (mostly image/TTS/STT/search services Goose can't run, plus a literal copy-pasted "one of https://docs.litellm.ai/docs/providers" placeholder row) down to 23 providers actually reachable through Goose, with model lists and base URLs pulled directly from Goose 1.50.1's own source (crates/goose-providers + its 46 declarative provider definitions) instead of carried over unverified.
• Update providerAPIKeyEnvVar/gooseProviderID in internal/executor/provider.go to match: routing for 9 new providers plus 6 whose Goose-registered id differs from Paca's existing llm_provider value (e.g. dashscope→alibaba), keeping Paca's own key names unchanged so no already-configured agent breaks.
• Deliberately left out (and removed from the picker rather than left silently broken): Bedrock, Databricks, Azure Foundry, Snowflake, SageMaker, local Ollama, GitHub Copilot — these are real Goose providers but need more than a single API-key env var (AWS credential chains, host+token pairs, OAuth device flow), which is outside what provider.go supports today. Tracked as a follow-up rather than half-wired.
• Update the ACP wire-format doc comments in internal/acp/types.go/client.go to record what was actually re-verified against 1.50.1 vs. what still rests on the 1.46.0-era spike (session/load's replay behavior specifically wasn't re-exercised).

Test plan

• go build ./..., go vet ./..., gofmt -l clean across all changed Go files
• go test ./... (all packages) passes, including new provider_test.go cases covering the added/aliased providers
• Pulled the new pinned digest directly and smoke-tested it: goose --version → 1.50.1, goose acp --help/goose serve --help work, load_skill still present in the binary (8 matches, same as 1.46.0)
• Ran the real E2E suite's raw-image tests against the new digest: PACA_E2E=1 go test ./test/e2e/... -run 'TestACPClientAgainstRealGooseContainer|TestSandboxManagerLifecycle' — both pass, exercising a live ACP handshake + tool-call round trip through docker.Manager's production container-lifecycle code
• Built paca-agent-server-goose:dev from the updated Dockerfile end-to-end and verified goose --version, Node/@paca-ai/paca-mcp, and all provider-CLI packages inside it
• CI's test-e2e job (Node/MCP full-image build + dind-sidecar tests) — not run locally, let it run on this PR before merging

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes — verified the full 6-file bump against upstream goose v1.50.1 (registry + source), not just the diff.

• Goose image digest bump — services/agent-server/Dockerfile pins sha256:90ed80a6…, which I independently resolved from ghcr.io/aaif-goose/goose manifests for both 1.50.1 and v1.50.1 (identical digest), so the pin is real and immutable.
• Provider env-var / id mappings — internal/executor/provider.go grows to 25 env-var entries and 8 gooseProviderID aliases. I fetched each declarative definition from goose v1.50.1: all 15 added mappings match exactly (aimlapi/AIMLAPI_API_KEY, alibaba/DASHSCOPE_API_KEY, fireworks-ai, friendli, together, nvidia, plus cerebras/moonshot/minimax/novita/ovhcloud/perplexity/inception/vercel_ai_gateway/zai), as do their base_urls.
• Catalog trim — data/llm_models.json drops from ~92 LiteLLM-wide entries to 23 chat providers; every remaining key is resolvable by resolveProviderEnv, and each provider's model list matches its goose definition.
• Tests & doc comments — new table tests cover all 15 added providers and pass locally; the ACP comments now correctly scope what was re-verified on 1.50.1.

One minor stale reference (no action required): apps/web/src/lib/provider-logos.ts:13 still describes the raw catalog as "the full ~115-entry raw LLM catalog"; after this PR it is 23 chat providers. Comment-only, no functional impact. Removed-provider agents remain editable via the CUSTOM fallback in agent-detail.tsx, so the trim is safe for stored configs.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}