feat(product): identify this crate's backend traffic as opencompany - #513

The prior finding is resolved: HttpHubIdentityExchange in src/server/hub_identity.rs now attaches the product identity header to the /auth/me request.

The new src/harness/provider.rs changes match the PR description accurately. HostedProvider::invoke attaches the header unconditionally to its chat-completions POST (the sole production inference path), and request_plan attaches it only when provider == "managed", deliberately excluding openrouter, openai_compatible, and ollama as third-party BYOK endpoints. Three tests cover the positive case (managed gets the header), the negative case (openrouter/openai_compatible do not, and openrouter's own attribution headers survive), and a wire-level proof that HostedProvider::invoke sends x-sdk-name: opencompany on a real HTTP request. The description's call-site table, the load-bearing managed-only rationale, and the test breakdown all correspond to what the diff actually does. No new concerns. (1 earlier finding(s) still open) The code index is behind this pull request (indexed at 8b2bf54ac08a), so retrieved context may be out of date.

No findings.

Fixed since the last review

• Cover the product header on hub_identity's /auth/me call — src/server/hub_identity.rs now attaches the product identity header to the /auth/me GET request, matching the PR description's table entry for HttpHubIdentityExchange.