feat: quota-aware subagent model fallback chain (#374)

[Wibias]

Summary

Implements quota-aware subagent model fallback for thread_spawn child turns (issue #374).

• Adds subagentModelFallback and subagentModelFallbackPollMs config
• Rewrites child spawn requests at the proxy choke point before routing
• Skips quota-exhausted native models and recently failed routed models
• Supports per-agent TOML model_fallback merge
• Primes Codex pool quotas before spawn selection
• Records quota-like subagent failures for short TTL health blocking
• Adds /api/subagent-model-fallback management route
• Injects fallback-chain guidance into v2 multi-agent guidance

Verification

• bun run typecheck
• bun test tests/subagent-model-fallback.test.ts tests/multi-agent-compat.test.ts

Closes #374

Summary by CodeRabbit

• New Features
  • Added quota- and health-aware subagent model fallback that can automatically rewrite spawned targets and inject fallback guidance into multi-agent instructions.
  • Added a management endpoint to view/update the fallback priority chain and polling interval.
  • Added support for the {{fallback}} placeholder in multi-agent guidance.
• Bug Fixes
  • Improved thread-spawn rate-limit/quota failure detection and attribution, with more accurate rerouting and underlying request model updates.
  • Added dynamic Codex home resolution so environment changes are reflected after import.
• Tests
  • Added end-to-end tests for chain building/deduping, fallback selection, guidance rendering, and spawn reroute behavior.

[Ingwannu]

The requested fallback behavior is valuable, but the current implementation can repeatedly select an exhausted model or select against the wrong account. The unresolved findings are substantive: 429/402 are not classified, routed failures are cached under a different key than the configured slug, selection runs before pool account resolution and uses the main plan for pool accounts, native health is not account-scoped, the normal SSE path does not record failures, and combo/encrypted child paths can be rewritten incorrectly. Please rebuild the selection at the resolved routing/account boundary, validate configuration atomically, make the tests independent, resolve the current dev conflict, and re-request review.

[lidge-jun]

🔒 Under maintainer review — detailed feedback incoming

@lidge-jun (maintainer) has this PR in an active review pass. Please do not merge or close
it until the detailed review lands; a full comment with specific file:line findings,
failure modes, and suggested fixes is being prepared.

This PR is not part of the current integration batch. It is held back deliberately —
either because it touches a security boundary that MAINTAINERS.md requires an explicit
security review for, because it needs to be split into reviewable units, or because it needs
a rebase onto changes landing in dev right now.

Heads-up on rebasing: dev is receiving a coordinated integration batch today. If this PR
touches the same files, expect to rebase after that batch lands. The upcoming review comment
will name the exact overlapping paths so you only have to do it once.

No action needed from you until then. Thanks for the contribution and for your patience.

_{Review tracker: devlog/_plan/260725_pr_issue_rework · marker posted by the maintainer review pass}

[lidge-jun]

Thank you for the substantial quota-aware subagent fallback work. I found three correctness blockers that need to be resolved before merge.

1. src/codex/subagent-model-fallback.ts:275-281 starts quota refresh work with void and returns no promise. The caller at src/server/responses/core.ts:700-703 uses await maybePrimeSubagentQuota(...), but that await resolves immediately, so model selection can run on stale quota state. Return the actual refresh promise (with errors handled at the owning boundary) and add a deferred-promise regression proving selection waits for the refresh result.

2. src/server/management/agent-settings-routes.ts:328-331 silently removes invalid entries with filter() instead of rejecting the request. That violates the management API's atomic validation contract: a typo can persist a partially truncated fallback chain while returning success. Validate every item first, return 400 with the offending index/value, and mutate config only after the whole payload is valid. Add a regression proving one invalid entry leaves the previous config unchanged.

3. src/codex/subagent-model-fallback.ts:173-184 does not record ordinary rate-limit wording as a health block. Providers that report rate limiting without the currently recognized quota phrases remain eligible and are selected repeatedly. Normalize the existing rate-limit classifier into this health path and test representative generic 429/rate-limit messages without treating unrelated errors as quota exhaustion.

I appreciate the scope of this feature. The refresh must be truly awaited, settings updates must be atomic, and generic rate limits must participate in the same health block before the fallback chain is reliable.

Please also rebase onto current dev, which now includes #439's context-pressure fields in src/types.ts; preserve that public type contract.

---

_{Reviewed as part of a maintainer integration pass. dev moved to ebc62d1f today (7 PRs integrated); Cross-platform CI is green on ubuntu, macOS, and Windows.}