Consolidates 62 upstream commits (v0.67.4 -> v0.67.68) into the fork.
Preserves all fork-local work (OAuth cloak, antigravity pool, context
tiers, OSC 8 file hyperlinks, gemini3 sig skip, codex_cli_rs headers,
compaction context hooks, gpt-5.4 models).

Conflict resolutions (4 files):

- packages/ai/src/providers/google-gemini-cli.ts: layered upstream's
  onResponse hook call into our pool-aware retry loop; kept our
  finally-block pool.saveNow() path.

- packages/tui/src/utils.ts: adopted upstream's AnsiCodeTracker OSC 8
  impl wholesale. It's cleaner than our f16dfd5 version (preserves
  hyperlink across SGR reset via separate clear(), emits ST-terminated
  sequences). Dropped our 7d75fee SEGMENT_RESET fix since upstream's
  design never introduced the bug.

- packages/tui/src/components/markdown.ts: kept our resolveHref hook
  and wrapHyperlink helper but gated OSC 8 emission on
  getCapabilities().hyperlinks; switched to upstream's hyperlink()
  helper for consistency. Merges file path linking (ours) with
  terminal capability detection (upstream earendil-works#3248, #30a8a41f).

- packages/tui/test/{markdown,wrap-ansi}.test.ts: updated our OSC 8
  assertions to ST-terminated sequences (\x1b\\) to match new emitter;
  added setCapabilities({hyperlinks:true}) gating where needed;
  afterEach resetCapabilitiesCache to isolate test state.

Dependency upgrades from upstream:
- @anthropic-ai/sdk 0.73.0 -> 0.90.0
- @aws-sdk/client-bedrock-runtime 3.983.0 -> 3.1030.0
- @mistralai/mistralai 1.14.1 -> 2.2.0

Upstream features folded in:
- fix(ai): Opus 4.7 adaptive thinking + xhigh effort (earendil-works#3286)
- feat(ai): thinkingDisplay option (summarized/omitted/raw)
- feat(coding-agent): after_provider_response hook (earendil-works#3128)
- fix(ai): trust requested Codex service tier (earendil-works#3307)
- feat(bedrock): Bearer token auth for Converse API (earendil-works#3125)
- feat(agent,coding-agent): per-tool executionMode override (earendil-works#3345)
- feat(tui): OSC 8 hyperlinks with terminal capability detection
  (earendil-works#3248, #30a8a41f)
- feat(coding-agent,tui): argument-hint frontmatter in prompts (earendil-works#2780)
- Plus ~40 smaller fixes across ai/coding-agent/tui/agent.

Verification:
- packages/tui: 559/559 tests pass
- packages/ai: 144/144 OAuth cloak tests pass; all fork-local suites
  pass (antigravity-pool, context-tiers, gemini3-unsigned-tool-call,
  codex-stream, supports-xhigh, etc.). Remaining test failures (13)
  are pre-existing live-API E2E tests (no credentials in this env).
- packages/agent: 39/39 tests pass.
- packages/coding-agent: 1020/1021 tests pass; 1 flaky bash timeout
  test (passes in isolation), unrelated to merge.
- All four packages build cleanly.