Define whether delegate agents use BYOK or their default cloud model

[vanzue]

Problem

PR #447 adds a shared BYOK/custom model provider for the ACP agent pane. Provider adaptation currently happens only when wta-master spawns the ACP agent process.

The delegate path used by ?<prompt> launches the normal interactive agent CLI in a new terminal tab. It does not inject the selected provider configuration (COPILOT_PROVIDER_*, CODEX_CONFIG, or OPENCODE_CONFIG_CONTENT).

As a result, when the same agent is selected for both surfaces:

• the agent pane uses the configured BYOK endpoint and model;
• the delegate may use the agent CLI's default cloud model;
• a user with only BYOK credentials may see delegation fail because the CLI is not authenticated to its default cloud service;
• prompts may be sent to a different provider than the user expects from the visible agent-pane model selection.

Product decision needed

Define whether delegates should:

1. Use the selected BYOK provider when the delegate agent supports it, keeping the agent pane and ?<prompt> behavior consistent; or
2. Continue using the delegate agent's default cloud/provider configuration, treating agent-pane BYOK and delegation as intentionally separate settings.

If the second option is intended, Settings and delegate UX should clearly disclose that BYOK applies only to the agent pane.

Implementation considerations

Supporting BYOK delegates requires agent-specific environment/config injection across every delegate launch path:

• direct Windows process launches;
• PowerShell 7 and Windows PowerShell multiline-prompt wrappers;
• WSL launches;
• Copilot, Codex, and OpenCode provider mappings;
• credential isolation so provider secrets are exposed only to the selected delegate process.

The delegate model setting also needs a defined precedence relative to the BYOK model selection.

Acceptance criteria

• The intended provider behavior for delegates is explicitly defined.
• ?<prompt> does not silently use a different provider than the documented behavior.
• Users receive an actionable error when the required BYOK or cloud credentials are unavailable.
• Settings/help text explains whether BYOK applies to agent panes, delegates, or both.
• Automated coverage includes supported Windows shell paths and WSL where applicable.

Related: #447