feat: compile and enforce declared model policy

[mostlydev]

Problem

This change moves model/provider authority to the infrastructure layer instead of leaving it to individual runners.

The immediate driver was cllama model-policy work, but the merged branch also carried adjacent CLI and spike-harness changes that were needed to make the behavior testable and usable end to end.

What Changed

Compile model policy during claw up

• added policy compilation in internal/cllama/modelpolicy.go
• claw up now emits per-agent model_policy metadata into cllama context from the Clawfile MODEL directives
• this gives cllama a compiled allowlist/failover view of what each agent is allowed to use

Document the trust-boundary decision

• added ADR 019 to make the model-authority decision explicit
• added a detailed implementation plan covering policy compilation, enforcement, failover boundaries, and testing expectations

Wire in the proxy enforcement change

• bumped the cllama submodule to the policy-enforcing version from feat: enforce declared model policy in cllama cllama#4
• this is the runtime half of the feature; the root repo now compiles the policy that cllama enforces

Improve rollcall spike coverage

• rollcall spike now builds the local cllama/ under test instead of accidentally reusing a stale cached image
• PicoClaw now runs through its native path in the spike image instead of a background responder shortcut, so the spike exercises real proxy/session-history behavior
• added xAI seed support in the rollcall fixture so the spike can validate that path too

Improve update UX while this branch was open

These changes also landed on the same merged branch:

• added claw update
• changed release checks back to an hourly interval during active development
• updated user-facing guidance so the notice tells users to run claw update

Files of Interest

• internal/cllama/modelpolicy.go
• cmd/claw/compose_up.go
• cmd/claw/compose_up_test.go
• cmd/claw/spike_test.go
• cmd/claw/spike_rollcall_test.go
• examples/rollcall/Dockerfile.picoclaw-base
• cmd/claw/update.go
• cmd/claw/update_check.go
• docs/decisions/019-model-policy-authority-and-declared-failover.md

Testing

• go test ./...
• go test ./... in cllama/
• go test -tags spike -v -run TestSpikeRollCall -timeout 45m ./cmd/claw/...

Depends On

• feat: enforce declared model policy in cllama cllama#4