Fix QA findings: session model persistence, pre-provision native-tool validation, url output, native-tool error message

[rgarcia]

Four fixes on top of #51 (--mode / --native-tool action planes).

Named sessions forget model/mode/native-tool

Problem: a named session (-s foo) didn't remember which model it was driven with — cua -s foo do ... with an anthropic model followed by cua -s foo url silently fell back to the default openai model. Worse, an explicit mid-session provider switch could send a foreign previous_response_id (e.g. an Anthropic msg_ id) to the OpenAI Responses API.

Fix: named-session metadata now persists model, mode, and native_tool. setupHarnessRuntime defaults -m/--mode/--native-tool from the stored values when not passed explicitly, and after each run the effective values are recorded back. cua session start accepts -m to seed the session's model. Separately, responseThreadingDelta now takes the provider api and refuses to anchor previous_response_id on an assistant turn produced by a different api — an explicit provider switch replays full converted history instead (anthropic/google paths were already full-replay).

Tests: new harness-named-sessions.test.ts (persistence + default application) and cross-api anchor rejection tests in both the openai and tzafon threading suites.

Invalid mode/native-tool combos validated only after provisioning

Problem: an invalid combination (e.g. --native-tool computer_20260701 with an openai model, or --mode browser with a computer native tool) was rejected only after a Kernel browser had already been provisioned — wasting a browser and delaying the error.

Fix: setupHarnessRuntime calls resolveCuaRuntimeSpec(modelRef, { mode, nativeTool }) right after flag parsing and before provisionForFlags, so all three entry paths (print, interactive, one-shot actions) fail fast. Error wording unchanged — the same errors just fire earlier.

Tests: new cli-harness-validation.test.ts mocks provisionBrowser and asserts each rejection fires with the browser never provisioned.

cua url output wrapped in markdown

Problem: the url action could emit the URL wrapped in markdown (**https://…**, backticks), breaking consumers that expect a bare URL.

Fix: extractFirstUrl now also strips trailing *, _, and backticks (leading chars were never included since the match starts at the scheme), and the url prompt asks for a bare URL with no markdown.

Tests: new action-result.test.ts covering bold-wrapped, backtick-wrapped, trailing-punctuation, and plain cases.

Native-tool provider mismatch error omits the mode requirement

Problem: using an Anthropic native tool with a non-anthropic model produced an error that only mentioned the provider requirement, leaving the user to hit a second error about the mode pairing.

Fix: the provider-mismatch error in resolveNativeTool now states the full requirement: native tool "computer_20260701" requires an anthropic model paired with mode "computer"; got provider "openai". Ordering unchanged.

Tests: updated native-tools.test.ts assertions (and the new validation test above).

Validation

• npm run typecheck and npm run build:cli pass.
• @onkernel/cua-cli: 49 passed, 5 skipped (API-key-gated). @onkernel/cua-agent: 72 passed, 12 skipped.
• @onkernel/cua-ai: 142 passed, 1 failure in api-keys.test.ts — pre-existing and environment-caused (a real GOOGLE_API_KEY in the test environment overrides the fixture; the test passes with the env var unset). Not touched here.
• ptywright native build not run (requires zig); unrelated to these changes.

Nothing was left unfixed — all four issues are addressed in this PR.