fix: retire claude-3-haiku-20240307 and gpt-4o (closes #44)

[stackbilt-admin]

Summary

Closes #44 — P0 model retirement fix flagged by AEGIS ecosystem-pulse.

• Haiku 3 (claude-3-haiku-20240307) retires 2026-04-19 (2 days out)
• GPT-4o (gpt-4o) retired 2026-04-03 (14 days silent in this repo)

Both IDs were live in the public MODELS constants, both provider models[] arrays, both capabilities/pricing tables, and 43 test fixtures — consumers resolving them would silently break at the cutoff.

Changes

• MODELS.GPT_4O and MODELS.CLAUDE_3_HAIKU marked @deprecated (values retained per additive-only OSS policy — removing the exports would be a breaking change requiring a major bump; JSDoc flags callers at compile time).
• claude-3-haiku-20240307 removed from AnthropicProvider.models[] and its capabilities/pricing entry.
• gpt-4o removed from OpenAIProvider.models[] and its capabilities/pricing entry. Dead gpt-4-turbo-preview alias also dropped (caught by the new drift test — had no capabilities entry to begin with).
• 41 Haiku-3 test-fixture IDs migrated to claude-haiku-4-5-20251001.
• gpt-4o test-fixture IDs migrated to gpt-4o-mini.
• New src/__tests__/model-drift.test.ts — asserts every provider's models[] is symmetrically covered by its capabilities map. Guards against this class of drift in the future.

Not in scope

• gpt-4o-mini status unconfirmed. It's the factory's default OpenAI fallback (factory.ts:1107, openai.ts:153,308,486) and the current default vision model when OpenAI is the only provider. AEGIS flagged gpt-4o proper, not mini — but both should be audited. Deliberately left untouched pending confirmation.
• Broader Claude 3 family (claude-3-opus-20240229, claude-3-sonnet-20240229) — not flagged by AEGIS routine, left in place.
• Deprecation console.warn at provider boot — considered but out of scope; the compile-time @deprecated is the minimum viable signal.

Test plan

• pnpm test — 229 passed (219 existing + 10 new drift tests)
• pnpm typecheck — clean
• Reviewer: confirm semver — this is a minor bump (1.3.0 → 1.4.0) since behavior changes (models drop from advertised list) are additive at the TypeScript type level.
• Reviewer: decide on gpt-4o-mini — follow-up issue or expand scope here?

🤖 Generated with Claude Code

[stackbilt-admin]

Addressed both cleanup items:

1. Whitespace noise in `src/index.ts` — stripped. `git checkout origin/main -- src/index.ts` then re-applied only the two `@deprecated` JSDoc lines via sed (preserving the file's existing CRLF endings on those insertions). Diff on `src/index.ts` is now +2/−0, content-only. Verified with `git diff main -- src/index.ts`.

2. CHANGELOG.md entry — added `## [1.4.0] — 2026-04-17` with `### Deprecated`, `### Removed`, and `### Added` sections per Keep-a-Changelog. Also bumped `package.json` to `1.4.0` (matches the feat(cloudflare): add vision support (Gemma 4, Llama 4 Scout, Llama 3.2 Vision) #43 pattern of inline version bumps).

Follow-up filed: #46 — verify `gpt-4o-mini` retirement status and migrate fallback sites if retired. P1.

Amended commit + force-pushed (`d9e1266...a3c57fb`). `pnpm test` still green (229/229).