Fix scoped temporary model selection and reasoning controls

[witbrock]

Merge decision: ready — the temporary model picker offers scoped executable catalogue entries and sends the selected reasoning effort for one turn, including queued turns.

User outcome

The picker previously offered provider-catalogue models which Von would reject as disabled, and provided no reasoning selector. It now intersects discovery with the trusted actor's resolved enabled pool using the execution gate's exact provider/model normalisation. Settings discovery remains available for enabling additional models; Ollama retains its existing local-execution exception.

Native assignment: #V#task_agent_8a925d88fa83a8889fe05cd36b8dcb98 (Michael Witbrock).

Material changes

• Add a no-store scoped catalogue endpoint, with eligibility failures distinct from an empty pool. Actor/organisation/settings changes invalidate temporary choices and pending reads.
• Add a capability-driven reasoning selector with provider defaults, fixed values, unsupported/failure states and one-turn request propagation.
• Give registry-only models, including gpt-6-astra when declared supported, the provider parameter mapping and value domain. Explicit registry values, fixed values and omissions remain authoritative. No model is enabled by these metadata changes and no blanket GPT-6 support is inferred.

Evidence

• 24 targeted backend tests pass: settings enabled catalogue, model parameters and execution eligibility.
• 11 picker/settings frontend tests pass; two targeted chat tests prove immediate request and queued replay preserve reasoning effort and restore defaults.
• Playwright passes with the actual candidate picker module and model-section template against synthetic catalogue/capability data; selection, payload, reset, unsupported models and invalidation checked. No provider generation or live writes.
• Changed-JavaScript static lint and git diff --check pass.
• Broader queue suite: two conversation activity-badge assertions fail on both candidate and unchanged baseline chat module (Queued / Running labels absent). Other 33 queue tests pass; these pre-existing failures do not change the merge decision.

Ship boundary

Minimum criteria are exact scoped catalogue filtering, reasoning selection reaching the request, and registry-only reasoning metadata reaching provider kwargs without weakening execution eligibility. The targeted tests and browser fixture cover those criteria.

The historical user/organisation rejection configuration and the live Astra registry entry remain unverified. Browser evidence is synthetic fixture acceptance, not authenticated/public-service or provider acceptance. The retained authenticated browser helpers are bound to other candidates and were not reused. No deployment, registry mutation, credential change or schema migration is requested or performed.