[Story]: A throttled gateway degrades to a retry, never to an empty model picker

## Story Statement

As a developer using the Lightbridge provider, when the gateway throttles me, my model picker
keeps working and my request retries — instead of the models vanishing.

## Real Intent

A 429 is the gateway answering clearly: *ask again later*. The extension currently treats it as
"you may not have these models" and returns an empty list, which reads to a developer as a
broken product.

## Background and Context

`catalogue.ts` throws on `!res.ok`; `provider.ts` catches and returns `[]` with a comment that
is correct for a gateway which has *stopped answering* and wrong for one that is throttling.
`crates/governance-copilot/src/client.rs` already implements the right shape — bounded backoff
preferring the server's `Retry-After`, with a test pinning that preference.

Bundled with this: `provideTokenCount` is the only function shipped untested, and VS Code uses
it to budget prompts, so a silent under-count truncates conversations.

## Source of truth (links)

#232 · #231 · `crates/governance-copilot/src/client.rs` · [microsoft/vscode#314722](https://github.com/microsoft/vscode/issues/314722) (why the 0% panel is NOT ours)

## Acceptance Criteria

- A 429 on the catalogue path retries honouring `Retry-After`; if still throttled, the cached
list is served **only while within `catalogueTtlMs`**, so a withdrawn model still disappears
within the TTL.
- A 429 on the chat path retries **only before the first part is reported to `progress`**; a
mid-stream 429 surfaces as an error and never re-emits delivered text.
- `provideTokenCount` has tests covering a plain string, a message with text parts, a message
with unknown parts, and an empty message.
- **Falsification:** break `extractText` to return `''`, watch the token-count test fail,
restore. State that you did.

## Out of Scope

Proactive throttling — the gateway advertises no limit headers, so pacing means guessing.

## Dependencies and Blockers

None. Independent of #230.

## Assumptions

The gateway returns a standard 429; `Retry-After` may be absent, so backoff must not require it.

## Implementation Notes

The catalogue's in-flight de-duplication already collapses a burst of picker queries into one
request — no extra client-side queue needed.

## Test Expectations

Integration scenarios against the in-process fake gateway, which can already return arbitrary
status codes.

## Verification evidence

To be filled at close: the retry test output, and the falsification run.

## Human accountable owner

@stephane-segning

## AI Usage Declaration

AI-assisted. Current behaviour read from the merged source; gateway headers measured live.

## Human verification completed

- [ ] Reviewed