fix(spawn): deterministic provider glob semantics and canonical async model resolution

[Sam Schillace (ramparte)]

This change fixes provider preference handling when model names are specified as glob patterns and makes model glob resolution deterministic and platform-independent.

Key points:

• Deterministic glob semantics: matches are performed case-insitively by lowercasing both pattern and candidate model names before matching. This avoids OS-dependent behavior from fnmatch and yields stable, cross-platform results.
• Async canonical provider resolution: when resolving a model glob, the code now resolves the preference against the selected mount's canonical module id and queries the provider instance's async list_models() when available. If a pattern cannot be resolved (no matching models), the preference is skipped instead of writing unresolved glob strings into the mount plan.
• Safety: preference config merging never overwrites PROTECTED_CONFIG_KEYS (credentials, endpoints, etc.). When a preference is applied, the provider is promoted to priority=0 and default_model is set to the resolved concrete model name.
• Tests: updated tests in tests/test_spawn_utils.py cover the case-insensitive deterministic matching and fallback behavior.

Compatibility / risk:

• Minimal: the new deterministic matching may select a different model if providers expose multiple models that only differ by case; this change is intentional to ensure consistent behavior across platforms.
• Providers that do not implement list_models() (or return empty lists) will cause glob resolution to fail and the preference will be skipped. Callers that relied on unresolved glob strings being written into mount plans should instead provide concrete model names or ensure provider list_models() is implemented.

If you'd like, I can re-run the test-suite or adjust the change to preserve previous behavior in a compatibility mode.