Model tiering foundation: config/models.conf + doctor checks

[yihanzhu]

Context

Fabrica currently runs every role on implicit defaults: coder subagents inherit the frontier session model (dominant cost / usage-throttle driver), while the Codex reviewer and manager-debate silently inherit the operator's personal ~/.codex/config.toml (currently low reasoning effort — the opposite of intent). Approved design principle: spend by leverage, not by volume — gates (review/debate) always at max capability; producers (coder/hands) at fixed modest ceilings, never escalated at runtime.

Spec

• Add config/models.conf (shell-sourceable, POSIX-safe) with exactly these keys and defaults, with comments explaining semantics:

# Producers — fixed ceilings by design; never escalated at runtime
FABRICA_CODER_MODEL=sonnet   # floating Claude alias; full IDs allowed to pin
FABRICA_HANDS_MODEL=haiku
# Gates — always maximum capability; no class-based routing
FABRICA_CODEX_MODEL=         # empty = inherit operator/CLI default (frontier codex)
FABRICA_REVIEW_EFFORT=high
FABRICA_DEBATE_EFFORT=high

• Per-target override: a same-format, same-keys file committed in the target repo, sourced AFTER the defaults. Mirror the per-target state convention established by the north-star work (Per-target north star (98a): atomic gate+doctor+persona flip, reading committed target state #101/Greenfield tie-in + MapleFolio history (98b): bootstrap creates committed target north star #104) for its location; document the chosen path. Overrides are static per-repo commitments, never per-task rescues.
• Doctor: extend the existing doctor check(s) to validate: config file present and sourceable; coder/hands values non-empty; warn if CLAUDE_CODE_SUBAGENT_MODEL is set in the environment (it would silently override per-spawn model params). Static checks only — no live API probing.
• Add config/models.conf to ci/required-files.txt.
• README: document the model policy and the spend-by-leverage principle.
• No behavior change in this PR — nothing reads the config until follow-up issues land.

Follow-ups: gates wiring, coder spawn wiring, hands policy (filed separately).