[codex] Expose deploy config mechanics

[xu16601526267]

Summary

This PR fixes three product-mechanism issues that made AIMA deploy troubleshooting hard to trust:

• separates deploy.dry_run resolved catalog/default config from the effective config after CheckFit runtime adjustments
• filters LLM-only CLI flags before emitting runtime command args for non-LLM service wrappers such as image/ASR/TTS services
• exposes service/catalog context in status and diagnostics so UI/CLI context splits and stale overlays are visible

Details

deploy.dry_run now keeps the legacy config field as the effective deployment config for compatibility, while also adding resolved_config, effective_config, fit_adjustments, resolved_provenance, and effective_provenance. This prevents UI/agent callers from confusing catalog defaults with resource-driven automatic adjustments.

Runtime flag generation now accepts catalog model type and engine context. LLM knobs like max_model_len, gpu_memory_utilization, and mem_fraction_static are preserved for LLM/vLLM/SGLang-style commands, but are not passed into service wrappers that do not expose those flags.

system.status, system.diagnostics, and catalog status now include service context such as data_dir, overlay_dir, catalog load time, latest overlay mtime, and a reload hint when overlays changed after the process loaded the catalog.

Validation

Passed:

• go test ./internal/knowledge
• go test ./internal/runtime -run "TestConfigToFlags" -count=1
• go test ./cmd/aima -run "TestResolveDeploymentKeepsResolvedAndEffectiveConfigSeparate|TestServiceContextReportsStaleOverlayHint" -count=1
• git diff --check

Known local Windows environment failures when running go test ./internal/knowledge ./internal/runtime ./cmd/aima:

• TestBuildRunArgs_ModelFileVolume expects Unix /mnt/... Docker volume formatting but the test ran under Windows paths
• several native stale-port tests fail under this local Windows process/port behavior
• TestResolveLocalModelPathNoPullUsesSymlinkMirrorSource cannot create symlinks without elevated Windows privileges

[xu16601526267]

Superseded by the split draft PRs: #63 for dry-run resolved/effective config, #64 for engine-aware config flag filtering, and #65 for service/catalog context diagnostics. Closing this aggregate PR to keep review boundaries clean.

[xu16601526267]

Closing in favor of split draft PRs #63, #64, and #65.