Compare Codex probe request shapes on the same candidate

[HTExplicit]

Live borrowing results still vary between source candidates. Comparing different runs cannot distinguish a request-shape discrepancy from a different route or an upstream failure.

Add an optional probe_contract scenario to the existing authenticated administrator diagnostic endpoint. It freezes one candidate and target request template, then compares the pinned ranxi body order without a tier, that body with the final tier, and the current body with the same tier. The selected real model never changes; Sol is explicitly identified as the downstream model extension. All pairs use the existing sender, independent per-shot legacy session IDs, fixed cookie, native identity, proxy and strict STATE criteria.

Results are explicitly probe-only: they preserve both terminal outcomes, STATE lengths, exact shape and context/body fingerprints, but never publish a business qualification or overwrite real usage evidence. Source acquisition and all comparisons remain within the existing eight-request cap, and expiry or cancellation stops the fixed-candidate comparison. No configuration, account health, scheduling, billing or normal business behavior changes.

Validation: focused tests cover both real model names, reuse of a still-live candidate without early renewal, one-candidate identity retention, semantic tier versus body-order differences, continued comparison after a failed verdict, no qualification/usage writes, request budget, cancellation, candidate expiry, and effective tier policy (including no model calls when blocked). The existing native HTTP tool-continuation regression passes. Actual protocol conclusions remain pending the controlled live comparison; this diagnostic addition is not presented as a completed borrowing repair.