feat(subagent): surface unset model-fallback on retryable failures + ARMORY_FLEET_MODEL_FALLBACK=auto (#58)

[rz1989s]

Problem (#58)

A retryable provider failure (stopReason 'error') with neither a per-dispatch modelFallback nor the global defaultModelFallback silently skipped auto-retry — the dispatch just failed and the operator had no signal that a safety feature was off.

Changes (per the issue's rec: visibility first, auto as opt-in)

1. Visibility — tools/subagent.ts: when a dispatch fails retryable and NO fallback is configured, the surfaced error now appends:
   (no modelFallback configured — pass modelFallback or set ARMORY_FLEET_MODEL_FALLBACK to enable one-shot auto-retry)
   …exactly when the missing fallback matters. Mutually exclusive with fix(subagent): surface primary error when fallback retry masks it + journal failure reason (#59) #69's composed primary+fallback error (a retry implies a fallback existed).

2. auto sentinel — ARMORY_FLEET_MODEL_FALLBACK=auto resolves a fallback per session from the runtime's configured+available snapshot via a new pure helper resolveAutoFallback (engine/auto-fallback.ts):

   • prefers the first model from a different provider than the session model (a real fallback family — the "Ollama primary + OpenRouter fallback" pattern, without hardcoding providers, unlike the enhancement: builtin model tiers hardcode Ollama — default to an "inherit" sentinel so they're provider-agnostic #64 tiers anti-pattern);
   • falls back to a different model id on the same provider when no other provider is configured;
   • undefined on single-model setups → auto-retry stays off + a one-time session warning says why.
     Wiring: index.ts init uses non-auto env values verbatim (unchanged); session_start resolves auto (needs the session model to differ from).

Tests

• New test/auto-fallback.test.mts (5): different-provider preference, same-provider fallback, single-model → undefined, empty snapshot → undefined, never picks the session model itself.
• Tool tests (2): retryable failure without fallback → hint present (keeps original failure text, names the env var); with per-dispatch fallback → hint absent.
• 709/709 pass, pnpm typecheck clean.

Closes #58