fix(tui): /model effort radios Low|Medium|High + Tab

[echobt]

Summary

Live /model did not match the lock boards: Effort was a standalone numbered picker (/effort), not Low | Medium | High radios with Tab.

This PR:

• Paints Effort radios on the live /model picker (○ Low ● Medium ○ High)
• Tab cycles Low → Medium → High
• Confirming a model also applies the selected effort
• /effort opens the same /model picker (alias). No A★ / standalone effort list
• Leaves alternate_screen default always (312a08dd) unchanged

Soak

Staging hop was not available: scripts/cursor-staging-access.sh is absent, tip sha-81f469c7 is not in this repo, no AWS_* env, no aws CLI, 127.0.0.1:18081 is not listening, CORTEX_API_KEY unset. No SSO attempted.

NEED_CURSOR_STAGING_ENV for live API. Local TUI smoke ran instead.

Test plan

• cargo fmt --all -- --check
• cargo clippy -p cortex-tui --all-targets with scripts/clippy.sh allow-list (-D warnings)
• Targeted tests (not full --workspace): cortex-tui interactive / lock_proof / executor; cortex-engine alternate_screen + harness + tools; cortex-cli --alternate-screen
• TUI / snapshot tests for /model radios, dual-hairline composer, splash Welcome to Cortex
• cargo audit (not re-run in this soak)
• Full cargo test --workspace (not re-run in this soak)

Attestation (required)

I attest that:

• Security reviewed — auth, exec/sandbox, path traversal, network egress, and secret handling in this diff were reviewed. No secrets, tokens, or keyring dumps are in the change.
• Product-facing errors — user-visible failures use Cortex product copy. API-down paths say The coding service is temporarily unavailable. No raw provider, SDK, or transport names.
• TUI verified — every TUI surface touched in this PR was exercised (build + headless snapshot / ratatui-style test). Staging E2E was not run (NEED_CURSOR_STAGING_ENV).
• Tests added — unit tests cover Tab cycling and radio paint; /effort dispatch opens ModelPicker. No mocks that report success.
• No secrets — no API keys, WorkOS secrets, R2/AWS credentials, or .env files are included.

Risk

Low. Session thinking budget is still an in-memory string. /effort now lands on /model instead of a separate list. No auth, sandbox, or API-contract change.