feat(cli): select current session model in shared TUI

[limityan]

Summary

• let Embedded and opt-in Shared TUI use /models to change only the current Session model
• route Shared changes through the existing private Runtime IPC and the same AgentSessionModelPort owner used by Embedded TUI
• keep model catalog/default management outside the Shared protocol and hide model editing in Shared TUI
• reuse one non-blocking Session update path for Agent mode and model changes, including active-turn rejection, failure, timeout, disconnect, and session-switch behavior
• restore and display the Runtime-owned model identity, including automatic model migration events

Architecture and behavior

• private IPC advances to v4 with one closed UpdateSessionModel operation; no SDK Host, public protocol, model catalog, or default-setting operation is added
• the Shared client reads the existing local first-party catalog only for picker/display data; the Runtime remains authoritative for validation and Session persistence
• Chat /models now has current-Session scope in both deployments; Startup model selection remains the default for future Sessions
• Shared TUI does not expose model editing, while Embedded TUI keeps its existing management entry
• auto, primary, and fast remain Runtime-owned Session selectors; the local catalog resolves them only for picker highlighting and readable display
• model updates persist a candidate before changing Runtime memory; a persistence failure restores the previous snapshot instead of leaving TUI and Runtime state split
• automatic migration events update the TUI only when both the Session ID and previous model selector still match, so other-Session and stale events cannot overwrite a newer selection
• an unknown update outcome closes the Shared view and requires restoring the Session before retrying; updates are never retried automatically

Explicitly out of scope

• model catalog/default synchronization over IPC
• GUI, Headless CLI, ACP, SDK Host, Peer, or remote consumers
• Session delete/fork, observer, replay, controller transfer, or multi-Session multiplexing

Validation

• cargo check --workspace
• cargo test -p bitfun-agent-runtime-ipc (32 passed)
• cargo test -p bitfun-cli --test product_assembly_cli (10 passed)
• CLI binary tests (440 passed; five pre-existing Windows Dispatch filesystem/process tests remain excluded from the success count)
• focused Core model persistence/list projection tests (5 passed)
• focused CLI model display, migration, and restore-notice tests (11 passed)
• node scripts/check-core-boundaries.mjs
• node scripts/check-repo-hygiene.mjs
• git diff --check

The five excluded Dispatch tests do not overlap the changed files; they reproduce on this Windows checkout through access-denied, process-claim, lock, and process-identity baseline behavior.

Two independent adversarial reviews covered the complete PR from architecture and product perspectives. Their persistence-consistency and stale-event findings were fixed and re-reviewed; final P0/P1/P2 counts are zero.