USAi model sync: validate remote limit fields before rendering JSONC

[wz-gsa]

Problem

integrations/isolation/acq-kits/usai-provider/scripts/sync-usai-models.mjs and the mirrored sbx-kits copy render limit.context and limit.output from remote models.dev data directly into opencode.jsonc without type validation. Costs are normalized before rendering, but limits are not.

A malformed or compromised models.dev/api.json entry can inject arbitrary JSONC keys or make the generated config invalid, for example:

limit: { context: '1, "pwned": true', output: 65536 }

emits:

"limit": {
  "context": 1, "pwned": true,
  "output": 65536
}

and context: "not-a-number" emits invalid JSONC ("context": not-a-number).

Expected fix

Normalize remote limits before rendering:

• Accept only finite positive integers for limit.context and limit.output.
• Fall back to FALLBACK_LIMITS when the remote value is absent or invalid.
• Add regression tests proving string/object/null/NaN-like limits do not inject keys and keep JSONC parseable.

Context

Found during adversarial review of PR #281. The PR already does the right thing for cost; limits need the same treatment.

AI-assisted (OpenCode). Requires human review.