#75 feat: discover current CLI models and expose reasoning effort

The spawn dialog's bundled lists miss versioned Claude models and current OpenCode choices. It also applies a hidden Codex effort default without an explicit model-aware control.

Discovers installed-CLI catalogs for localhost brokers using portable PATH/home resolution, bounded discovery, a shared ten-minute cache and per-provider fallback. The dialog offers advertised effort levels; CLI defaults remain unless explicitly overridden. Structured effort reaches local/cloud transports. Local validation translates it into native Claude/Codex arguments or process-local OpenCode model/variant configuration, preserving explicit PTY launch settings.

Validation:

• 671 tests passed (418 dashboard, 253 server), including regressions for aliases, advertised variants, configuration isolation and agent defaults. The server suite passed with two workers after three existing tests timed out in the default parallel run.
• Windows: both package typechecks, dashboard-server build, production UI build and dashboard server-entry build passed.
• Isolated production-build browser smoke verified versioned models, current OpenCode options, effort selection/reset and unsupported-model behavior.
• Live installed-CLI discovery, native Windows OpenCode executable resolution and a controlled default-agent configuration lookup passed without model prompts.

Compatibility:

• Remote brokers retain the bundled registry; cloud adapters forward effort to their host API. The legacy orchestrator hides the control because its API cannot carry effort.
• OpenCode effort requires harnessConfig.env support (verified with broker 14). Implicit default-agent lookup requires an absolute worker directory; remote brokers, custom launchers or unavailable defaults require an explicit --agent. Dashboard inline configuration is inherited only for local brokers. Older brokers and native broker/model execution are not covered by the transport tests.
• Linux/macOS execution awaits CI/maintainer verification. Excludes generated assets, personal paths, credentials and self-hosting patches.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

[!NOTE]
Medium Risk
Changes agent spawn payloads and runs local CLI discovery with harness/env rewriting for OpenCode; mitigated by validation, timeouts, and remote-broker isolation but still affects launch behavior.

Overview
Adds local model discovery for localhost brokers: Claude/OpenCode via bounded CLI probes and Codex via models_cache.json, with a 10-minute shared cache, per-provider fallback to bundled/cached catalogs, alias resolution, and catalogWarnings when discovery fails. Remote brokers keep the bundled registry only.

The Spawn Agent flow gains an opt-in Reasoning effort control driven by per-model metadata from /api/models, replacing the previous silent Codex effort injection in spawn commands. Effort is sent as a separate field through local and cloud spawn APIs; the broker proxy validates it against the catalog and returns HTTP 400 when unsupported.

Server-side translation maps effort to native launch settings: --effort for Claude, model_reasoning_effort for Codex, and process-local OPENCODE_CONFIG_CONTENT (with default-agent discovery via debug config on local brokers). The legacy orchestrator path hides the control and errors if effort is set. README documents discovery, caching, and compatibility limits.

^{Reviewed by Cursor Bugbot for commit 6022c66d0962a6574522ecec00e58a8d6ae132a8. Bugbot is set up for automated code reviews on this repo. Configure here.}