[codex] Explicitly request Commander roster model overrides

[tmhise]

A configured Commander roster can be visible to a Codex parent while every child still inherits the parent model. The parent must pass the selected ID in spawn_agent.model; advertising a roster does not select a worker. This change makes that request explicit in the managed policy and skill, and preserves model-selection instructions through custom V2 prompts.

Observed issue and instruction ambiguity

In an affected native Sol conversation, earlier spawn calls supplied Luna and DeepSeek model IDs. Later calls omitted model, even though Commander still injected the roster. Those children inherited Sol, and Commander's serving records show Sol was already the requested model. There was no proxy-side substitution of Luna or DeepSeek.

The native collaboration instructions permitted model overrides when explicitly requested by the user, applicable AGENTS.md, or a skill. Commander's generated policy said to consult the roster and match work to task fit, while its skill conditioned overrides on the active contract permitting them. Neither clearly supplied the explicit request in the instruction source Codex expected.

The custom injectionPrompt path compounded that ambiguity: it returned the customized text in place of the built-in selection instructions and expanded {{roster}} without per-model guidance. A valid custom prompt could therefore preserve model IDs while dropping the instructions for selecting and passing them.

These are verified instruction gaps and observed omission/inheritance behavior. The parent's private reasoning is unavailable. The same native override restriction appeared in both successful and affected calls, so this PR does not attribute the change to a Codex update.

Change and reason to merge

• Explicitly request task-fit exact model overrides in both managed instruction sources. Explain that omission inherits the native parent/default. Keep these artifacts free of fixed model IDs.
• Retain a shared selection contract in built-in and custom V2 guidance whenever an eligible preferred model or roster exists. Use fork_turns: "none" for overrides.
• Expand custom {{roster}} with eligible per-model annotations, preserving the guidance operators configured.
• Add regression coverage for both managed modes, retained custom-prompt instructions, and exclusion of ineligible roster notes; update the user docs and architecture notes.

This closes a gap between Commander's roster configuration and Codex's explicit-override contract without requiring operators to repair each custom prompt themselves. Freshness, route, surface, encrypted-task compatibility, and native validation gates remain authoritative. The change clarifies the model's instructions; it does not guarantee a particular model choice on every task.

Validation

• bun run typecheck and bun run privacy:scan passed.
• 87 focused delegation-template and collaboration tests passed; 89 additional installer/API tests passed during independent review.
• The 631-file bun run test:parallel run completed its initial work queue. The shim failure passed its automatic same-mode retry. The eight-file macOS packaging batch hit dependency-install timeouts with an empty isolated-home cache; its stuck retry was stopped, then only that same shared batch was rerun using the populated Bun cache with test-home isolation preserved: 58 passed, 0 failed. The original full-suite process did not exit zero; this is combined verification with the failed batch recovered in its original mode.
• Documentation build, local macOS app build, and git diff --check passed.
• Live behavior check: a native Sol parent received a task brief containing no child model IDs, read the refreshed managed policy, and independently selected Luna and DeepSeek. Both children completed and their correlated serving records returned HTTP 200.
• The rebuilt local runtime was activated and verified healthy with all four configured roster models available and zero stale Codex workers.

Activation for existing installations

Refresh the managed delegation setup through Commander's installer/dashboard after upgrading, then start a new Codex task so it loads the updated policy. Existing managed artifacts are ownership-checked and reported as outdated; merely pulling this source change does not rewrite an installed global policy.