feat(providers): add Kimi (Moonshot), GLM (Zhipu), DeepSeek

[csmatar]

Summary

Add three OpenAI-compatible providers — Kimi (Moonshot), GLM (Zhipu), DeepSeek — as
registry rows on the seam from #71. No adapter code: each is (base_url, env_var) data reusing the
shared openai.py translation. Closes #72, #73, #74.

Scope

• Ticket / spec reference: Provider: add Kimi (Moonshot) #72 · Provider: add GLM (Zhipu) #73 · Provider: add DeepSeek #74 (milestone: v0.4 Model Breadth)
• Layer(s) touched: adapters (composition.py), tests, docs
• Out of scope: pricing rows (advisory None, same rationale as Provider: OpenAI-compatible provider seam (+ Grok/xAI reference) #71), Gemini (Spike: Gemini id-less tool-call loop (native vs OpenAI-compat) #76/Provider: add Gemini (Google, native generateContent) #77)

Changes

• composition.OPENAI_COMPATIBLE gains three rows:
  • moonshot → https://api.moonshot.ai/v1 · MOONSHOT_API_KEY
  • zhipu → https://api.z.ai/api/paas/v4 · ZHIPUAI_API_KEY (international Z.AI host; China
    open.bigmodel.cn/api/paas/v4 noted in a comment)
  • deepseek → https://api.deepseek.com · DEEPSEEK_API_KEY
• Base URLs verified against each provider's current OpenAI-compatibility docs (Aug 2026).
• No changes above the port; application/loop.py untouched.

Testing

make check          # lint + typecheck + arch + test — all green
# 592 passed, 3 skipped (live), coverage 93.30% (floor 92%)

• Per-provider data contract: a parametrized make_gateway test pins every compat provider's
  exact (base_url, env_var) — a wrong host is the real risk, so it's asserted explicitly, not left
  to the shared construction path.
• DeepSeek reasoner: a deepseek_reasoner.json fixture (tool call + reasoning_content) proves
  from_wire extracts the tool call and ignores the chain-of-thought — the one genuine wire
  difference in this batch.
• Kimi / GLM chat are wire-identical to OpenAI, already covered by the shared openai translation
  tests. I did not manufacture duplicate per-provider tool-call fixtures — a byte-identical copy
  of the OpenAI fixture adds no signal, and real native payloads need direct keys (an OpenRouter
  capture would already be normalized to OpenAI shape, so it wouldn't catch native quirks). Flag if
  you'd rather have literal per-provider fixtures anyway.

Quality gate

• make check passes locally
• New/changed tests run offline — no network, no API key
• Architecture contracts kept (make arch)
• No unittest.mock outside tests/contracts/
• Ubiquitous language respected (ARCHITECTURE §3)

Scope discipline

• Nothing further-deferred built
• No ARCHITECTURE §11 tripwires

Public contracts

• Exit codes unchanged
• YAML suite format unchanged — new provider: values, not a schema change
• Trace JSON shape unchanged

Docs

• docs/Progress.md updated (Provider: add Kimi (Moonshot) #72/Provider: add GLM (Zhipu) #73/Provider: add DeepSeek #74 code-complete)
• docs/Learnings.md — no new pitfall beyond the Provider: OpenAI-compatible provider seam (+ Grok/xAI reference) #71 entry
• SPEC.md — provider matrix tracked in Docs: provider support matrix #78

Risks

• Direct-provider base URLs aren't exercised in CI (no keys); they're verified against docs and
  covered by the wiring test. The live path in CI/dev remains OpenRouter (Provider: OpenAI-compatible provider seam (+ Grok/xAI reference) #71).
• Providers ship unpriced by design (advisory None).

Follow-ups

• Provider: generic openai_compatible (user-supplied base_url) #75 generic openai_compatible (user-supplied base_url).
• Spike: Gemini id-less tool-call loop (native vs OpenAI-compat) #76/Provider: add Gemini (Google, native generateContent) #77 Gemini (native).
• Docs: provider support matrix #78 provider matrix docs — will tabulate all of these.

[csmatar]

Follow-up filed: #81 tracks capturing real native per-provider payloads for the direct-key path. The blind spot is that OpenRouter (our live path) normalizes every response to OpenAI shape, so no OpenRouter-sourced fixture can reveal a provider's native quirks — only a direct-key capture can. This PR now points at #81 from both the registry (composition.py) and the compat contract test, so the boundary is discoverable in code. Ships the OpenRouter path now; closes the direct path deliberately later.