fix(subagent): surface primary error when fallback retry masks it + journal failure reason (#59)

[rz1989s]

Problem (#59)

Dispatching a subagent with an explicit model string appeared to fail where the inherited session model succeeded — the surfaced error named the fallback model only. Two real defects hid behind that symptom:

1. Error masking: when the subagent: auto-retry with a fallback model on provider rate-limit / auth failure (Ollama-Cloud primary → OpenRouter fallback) #39 fallback retry also failed, only the fallback's error was returned. The primary's failure text was dropped entirely.
2. Journal gap: the run:ended journal event carried no error field — the archived failing runs (fl-msbwt1jj, fl-msbwwqpg) have empty resultSummary and zero diagnostic content, making post-hoc diagnosis impossible.

Investigation (closes the "explicit vs inherited divergence" theory)

• resolveAgentModel builds the inherit path's model as ${parentModel.provider}/${parentModel.id} from the live session model — so both paths resolve via the identical getModel(provider, id) call.
• Empirical probe of ModelRuntime.create() in this environment: getModel("Ollama", "glm-5.2:cloud") resolves cleanly (local models.json provider key, exact case). No runtime error.
• Conclusion: there is no code divergence between explicit and inherited model resolution; the observed asymmetry was transient provider failure (Ollama per-minute limits, 2026-08-08) made undiagnosable by the masking. The fix is diagnosability.

Changes

• tools/subagent.ts — after a failed fallback retry, compose the surfaced error with both attempts: primary '<model>' failed: <err>; fallback '<model>' failed: <err>.
• engine/retry-fallback.ts — same composed-error contract in withModelFallbackRetry (lifecycle/bg spawn sites).
• engine/spawnSubagent.ts — finishRun journals the failure reason on run:ended (conditionally, so successful runs stay unchanged).

Tests

• Composed error asserted on both retry paths (direct tool + lifecycle/bg wrapper): names both models, includes both failure texts.
• run:ended carries a meaningful error on failed runs.
• 702/702 pass (699 → 702), pnpm typecheck clean.

Closes #59