feat(product): identify this crate's backend traffic as opencompany - #513

The new src/harness/provider.rs changes are well-tested: the managed-provider positive case, the third-party negative case (openrouter + openai_compatible), and a wire-level proof on HostedProvider::invoke all assert on real behaviour and would fail on regression. The prior finding about hub_identity.rs remains open — the /auth/me call now carries the product header (a behaviour change) but still has no test, unlike every other call site this PR touches. (1 already reported on an earlier push) The code index is behind this pull request (indexed at 8b2bf54ac08a), so retrieved context may be out of date.

No findings.