[Feat] Add configurable model fallbacks

[roomote-roomote]

​Created by Roomote. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Added an opt-in fallback model and reasoning selection for every model role, stored independently from the existing runtime model mapping.
• Added shared provider-error classification and sticky fallback switching across task harnesses, mapped subagents, sessions, and control-plane helper calls.
• Added transcript notices, originating-thread notifications, anonymous fallback telemetry, public documentation, and contributor guardrails for future model roles.
• Prune fallback selections when their provider is removed or their model is removed or disabled, so later settings saves are not blocked by stale model IDs.
• Deliver child-task fallback notices to the owning session as dedicated durable events with redacted provider details; direct customer channels receive a fully static Roomote-controlled fallback notice with explicit non-terminal presentation.
• Stabilized the worker test suite with bounded fork concurrency and complete harness event mocks for the new fallback subscription.
• Kept OpenCode-private helper calls explicitly out of scope because their provider failures are not observable to Roomote.

Why this change was made

Provider quota, credential, model-availability, and transient failures should not strand running work when an administrator has configured another enabled model. The shared fallback contract keeps retry thresholds and long-lived model selection consistent across Roomote runtimes.

Impact

Fallback behavior remains off by default. When enabled, quota and supported 401/403/404 failures switch immediately, other eligible provider failures switch after three Roomote retries, and the selected fallback remains active for the rest of that task or session unless a person changes the model manually. Removing or disabling a provider or model now removes only affected fallback selections, and delegated-task fallback progress continues safely into its owning session and source conversation.

[roomote-community]

No new code issues found. See task

• Fast-originated child-task fallback notices are dropped instead of reaching the parent conversation.
• Removing a provider leaves stale fallback models that block subsequent fallback-setting saves.
• Disabling a fallback model leaves its stale fallback selection and blocks later fallback-setting saves.
• Fast fallback notices can forward provider-supplied credentials into the owning session.
• Fallback notices can post unsafe provider-supplied error Markdown into direct customer channels.
• Fallback notices still interpolate unrestricted model identifiers into direct customer-channel Markdown.
• Static fallback notices are rendered as terminal errors that say the task stopped even though it continues.

_{Reviewed b0d3638}

[roomote-roomote]

All Roomote review findings and the Test failure are resolved on b0d3638. Direct fallback delivery uses a fully static Roomote-controlled message plus an explicit fallback discriminator, so no provider/model/error data can inject customer-channel Markdown and the notice is never rendered as a terminal error. Worker Vitest concurrency is capped at four and every runTask harness mock implements the event subscription contract. The full worker suite passes 187/187 files and 2,162/2,162 tests locally. GitHub Test and Roomote code review checks now pass, all review threads are resolved, and all other current checks are green. Visual proof was not retried per the explicit timeout instruction.