Fix Claude principal and helper model attribution

[shiftynick]

What changed

• Distinguish Claude's principal response model from internal helper models.
• Expose helpers through helperModelsObserved.
• Fail closed when usage-only attribution is ambiguous.
• Aggregate duplicate canonical usage and exclude sidechain assistant events.
• Prepare the corrected contract as release 0.6.1.

Why

Claude modelUsage may list an internal Haiku helper before the explicitly
requested Opus or Sonnet reviewer. The previous normalizer trusted the first
entry, which could make independent-review evidence misleading.

Validation

• bun run check - 120 passed, 4 opt-in live tests skipped
• npm pack --dry-run
• npm run audit:prod - 0 vulnerabilities
• git diff --check
• independent Claude Opus 5 review - Proceed