fix(i18n/build/ci): ICU-escape 381 message values, externalize tiktoken, add blocking UI-ICU gate

[chirag127]

Summary

Three tightly-related fixes, verified live on the latest release/v3.8.51:

1. fix(i18n) — ICU-escape 381 message values containing raw <tag> / literal {...} across all 42 locale catalogs (src/i18n/messages/*.json).
2. fix(build) — externalize tiktoken in next.config.mjs so tiktoken_bg.wasm resolves at runtime.
3. chore(ci) — add a blocking check:ui-icu gate that compiles every message value with IntlMessageFormat (next-intl's parser), so this defect class can never ship again.

Background

A message value containing a raw <tag> or literal {...} fails to compile under IntlMessageFormat. At runtime the component silently breaks — the RSC/Flight path throws INVALID_MESSAGE and the UI falls back to showing the raw i18n key. This exact class shipped repeatedly:

• fix(claude): ccOnboardingKeyPlaceholder has invalid ICU tag in all 43 locales — INVALID_TAG crashes the Claude Code onboarding block #12302 — ccOnboardingKeyPlaceholder = <your OmniRoute API key> (crashed the Claude Code onboarding block)
• i18n: raw <name> tag in featureFlags.definitions.OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES.description (all 43 locales) breaks the Feature Flags page #12505 — OMNIROUTE_AUTO_SYNC_CLAUDE_PROFILES.description = ~/.claude/profiles/<name>/settings.json (Feature Flags page showed the raw key)
• i18n: raw <gateway-alias>/<model> tag in featureFlagExposeFunctionalGatewayMirrorsDescription (all 43 locales) breaks the Feature Flags page #12559 — featureFlagExposeFunctionalGatewayMirrorsDescription = raw <gateway-alias>/<model>
• plus literal JSON/regex paste-hint examples ([{ json, name?, email? }...]), a service-account JSON placeholder, regex samples, a broken <emdeze rich-text tag in nl, and two {" "} status-label artifacts (phi/sv)

The fix (commit 1)

Every literal is wrapped in ICU single quotes so it renders verbatim — required here because the values are copy-paste content (file paths, JSON, regex), where real </>/{ characters must render. HTML entities would corrupt the pasted content. Every single change was asserted render-identical (new IntlMessageFormat(fixed).format() === original) by scripts/ad-hoc/fix-invalid-icu.mjs; the only deliberate wording change is the nl <emdeze typo correction.

The duplicate 'in' locale was retired upstream in #12496, so the sweep covers the current 42 catalogs.

The gate (commit 3)

npm run check:ui-icu → scripts/i18n/check-ui-icu.mjs compiles all 545,817 messages across 42 catalogs. Legitimate t.rich rich-text ("<b>bold</b>") and normal ICU ({count, plural, ...}) compile fine — no false positives, pinned by tests/unit/i18n-ui-icu.test.ts (10 tests). Wired into the blocking i18n-ui-coverage job in .github/workflows/ci.yml.

The tiktoken fix (commit 2)

tiktoken resolves tiktoken_bg.wasm at runtime via fs.readFileSync relative to __dirname; bundled by Turbopack that lookup fails ("Missing tiktoken_bg.wasm") and 500s every route touching codex-chatgpt-web token estimation (e.g. GET /api/providers). Externalizing it (like sqlite-vec / better-sqlite3) keeps the require at runtime.

Verification

• check:ui-icu → PASS — all 545,817 messages in 42 catalogs compile
• tests/unit/i18n-ui-icu.test.ts → 10/10 pass
• check-ui-value-drift (against base) → PASS
• check-ui-keys-coverage → PASS

Note: intl-messageformat is currently a transitive dep of next-intl (^11.1.0) — the gate requires it, so if that dependency is ever dropped it should be promoted to a direct dependency.