fix(sync_models): protect MiniMax local profiles from pass-2 deprecation

Add the three MiniMax local-deploy profiles (minimax-m2-local,
minimax-m2-5-local, minimax-m2-7-local) to protected_profiles. Their
`model` fields are HuggingFace paths (MiniMaxAI/MiniMax-M2.X) that the
MiniMax /v1/models endpoint never returns, so merger.py's pass-2
deprecation check would mark them deprecated as soon as
_source_is_authoritative starts matching `<provider> API` against the
'manual' modelSource - the local profiles survive today only via an
unrelated string-mismatch quirk in that authority check.

Defense in depth - explicitly protect rather than rely on the quirk.

Addresses CodeRabbit review feedback on PR #1046.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: 2 people

tools/src/sync_models.config.json

@@ -423,7 +423,10 @@
 				["minimax-m2-5-highspeed", "2026-10-09"],
 				["minimax-m2-7", "2026-10-09"],
 				["minimax-m2-7-highspeed", "2026-10-09"],
-				["minimax-m3", "2026-10-09"]
+				["minimax-m3", "2026-10-09"],
+				["minimax-m2-local", "2026-10-09"],
+				["minimax-m2-5-local", "2026-10-09"],
+				["minimax-m2-7-local", "2026-10-09"]
 			],
 			"token_limit_overrides": {
 				// MiniMax's /v1/models endpoint doesn't return context_window. Lock every