Model-catalog shadow-compare fetch changes: network gating and caching

What

• The background "shadow compare" fetch that checks the served/published model catalog now unconditionally allows network access for its own fetch path (a related sibling call still gates access based on whether Claude Code is running headless). The shadow-compare fetch only runs at all if an internal mode check doesn't disable it (covering environment overrides, bare mode, non-first-party or non-claude.ai auth, missing organization, or policy).
• The shadow-compare check now first looks at a local cache entry and checks whether it is stale before deciding whether to make a network fetch, then writes the fresh (or errored) result back to the cache.
• If the fetch does not finish within a fixed time budget, it no longer blocks; instead it schedules a background check to finish later and logs a new model_catalog_late_fetch event.

Why These changes make the background catalog comparison less likely to block or make unnecessary repeated network requests, while keeping the feature itself gated off unless explicitly enabled.