feat(code-queue): register minimax-m3 alongside minimax-m2.7

Add minimax-m3 as a sibling model on the same path as the existing
minimax-m2.7 support. M3 is the new PROD default; M2.7 remains available
as a one-line rollback target via MINIMAX_MODEL.

Changes:
- code-agent/common.ts: add minimaxM3Model constant, include in
  defaultCodeModels, normalize aliases (minimax-m3 / m3), route to
  opencode port, sibling entry in codeModelProviderSourceContract.
- code-agent/opencode.ts: add M3 branch in openCodeModelId, register
  both M2.7 and M3 in openCodeConfigContent, inject MINIMAX_M3_MODEL
  in local/remote env, M3 branch in missingOpenCodeCredentialMessage.
- index.ts + types.ts: add minimaxM3Model to RuntimeConfig, read
  MINIMAX_M3_MODEL env, propagate to remoteCodexEnvKeys.
- queue-api.ts: include minimaxM3Model in Pick for
  codeModelProviderSourceContract callers.
- scripts/src/code-queue.ts: add minimaxM3SubmitModel, normalize/port
  routing, default route recommendation now points to M3, M2.7 kept
  as minimaxM2FallbackCandidate.
- scripts/src/docker.ts: default UNIDESK_CODE_QUEUE_MINIMAX_M3_MODEL
  to MiniMax-M3.
- k8s yaml (D601 + G14): CODE_QUEUE_MODELS gains minimax-m3, three
  deployments each set MINIMAX_MODEL=MiniMax-M3 and
  MINIMAX_M3_MODEL=MiniMax-M3.
- docker-compose.d601.yml: same env defaults for local compose.
- docs/reference/{code-queue-supervision,microservices,
  windows-passthrough}.md: update model contracts to M3 default +
  M2.7 fallback.
- scripts/code-queue-submit-routing-contract-test.ts: low-risk
  recommendation now asserts minimax-m3; registry asserts both M3
  and M2.7 fallback in modelPorts/opencodeModels; provider source
  contract test passes minimaxM3Model.

Refs: #189

docs/reference/windows-passthrough.md

@@ -198,7 +198,7 @@ Code Queue 支持在提交任务时选择 `executionMode=windows-native`。该
 
 约束：
 
-- 只支持非主 server WSL Provider 和 Codex 模型；`minimax-m2.7` / OpenCode port 不走该模式。
+- 只支持非主 server WSL Provider 和 Codex 模型；`minimax-m3`（默认）/ `minimax-m2.7`（回滚） / OpenCode port 不走该模式。
 - 工作目录必须在 `/mnt/<drive>/...` 下，供 `win-cmd` 转换为 Windows 盘符 cwd；D601 默认提示为 `/mnt/f/Work/ConStart`。
 - Windows 侧必须已安装 `codex`，且 WSL wrapper `win-cmd` 可用；可用 `bun scripts/cli.ts ssh D601 -- 'export PATH="$HOME/.local/bin:$PATH"; win-cmd "where codex && codex --version"'` 验证。
 - 任务 JSON、列表、Trace 摘要和前端卡片必须显示 `executionMode`，便于区分默认容器 Codex 与 Windows 原生 Codex。