Fix: Refresh pricing for unknown models

[iam-brain]

Closes #2017

Summary

• refresh the public pricing catalog when an exact scanned model remains unpriced, then rescan once only when foreground pricing becomes available;
• preserve exact model/token rows and return immediately on app/server background paths while a coalesced refresh continues;
• share one cache-scoped in-flight operation and 15-minute attempt cooldown across ordinary TTL and unknown-model triggers;
• recheck TTL freshness after coordination and keep unresolved unknown models from being masked by an already-priced member of the same request;
• add the maintainer changelog entry and preserve @iam-brain's contributor credit.

Proof

• focused ModelsDevPricingTests, CostUsageFetcherUnknownModelPricingTests, and CLIServeTimeoutTests: 55/55 pass;
• make check: pass; SwiftFormat, SwiftLint, generated parser hash, packaging/release scripts, docs, locales, and repository checks clean;
• make test: all 50 local shards pass on the exact rebased candidate;
• structured autoreview: clean before and after rebasing onto current main;
• exact Developer ID-signed debug app and bundled CLI: strict code-sign verification and Gatekeeper assessment pass;
• source-blind packaged validation: foreground repriced the exact 110-token row in the same 394 ms invocation; live server returned the same row unpriced in 43 ms, refreshed the isolated cache in the background, returned it priced on the next request in 51 ms, and released its listener cleanly on termination.

Public Model Identifier Gate: PASS. The live fixture uses only a released public model; test-only identifiers are clearly fictitious. Dependencies unchanged.

[steipete]

Exact-head landing proof for 0970fcf70f5496ab2f65ebb356034ad26f03faa2:

• focused pricing/serve suites passed 55/55; make check passed; all 50 local test shards passed;
• two structured autoreview passes were clean, including the rebased branch against current main;
• Developer ID-signed debug app and bundled CLI passed strict code-sign verification and Gatekeeper assessment; bundled CLI SHA-256: c3728537d96e368522564cd94c5c58c1ea725533aa74ddcaa9126e0b5219ffe8;
• source-blind packaged validation passed 4/4 clauses under disposable env -i homes with Keychain disabled: foreground repriced exact usage in the same call, the live server returned exact unpriced usage without waiting, background refresh made the next call priceable, a varied-token anti-cheat probe stayed exact, and termination released the listener/process;
• dependencies unchanged; no provider credentials, browser state, real home, or provider-auth endpoint used;
• hosted exact-head CI is fully green: lint, both Linux jobs, all four macOS shards, aggregate, and GitGuardian; no reviews or unresolved threads; merge state CLEAN.

Public Model Identifier Gate: PASS. Diff identifiers are clearly fictitious; live validation used only a released public model.