fix(agents): harden model routing and execution budgets

[ImPedro29]

Summary

• resolve built-in and custom worker models from authenticated router roles, semantic profiles, or exact catalog IDs
• preserve canonical plan-qualified IDs such as max/qwen3.6-27b and keep legacy external-provider routing compatible
• make haiku, sonnet, and opus inherit safely on providers that do not expose Claude aliases
• support profile:review-style model selection for inline and forked skills
• bound Explore to four API calls, 40 admitted tool calls, a 150-second soft deadline, and a 180-second hard deadline
• return partial findings on timeout without aborting the parent session
• preserve exactly one terminal tool_result for every emitted tool_use
• expose the effective model, completion reason, and execution-budget usage for diagnostics

This includes the useful catalog/profile ideas from #18 while keeping router-provided agent_model_roles authoritative. It intentionally does not ignore an explicitly requested worktree/isolation mode.

Validation

• focused routing, profile, skill, budget, timeout, and tool-pairing tests pass
• bun run build
• CLI smoke: node dist/cli.mjs --version
• bun run verify:privacy
• git diff --check

One existing skill-loader test hit its 5-second runner timeout once in the consolidated command and passed immediately when repeated in isolation (39 ms).