chore(pipelines): raise judgment-step model from cheapest to balanced

[nextlevelshit]

Summary

Real-world signal from Epic #1565 Phase 1 dispatch: cheapest tier (Haiku) produced shallow outputs on judgment-shaped work. Most visible cases:

• impl-issue contract: reject net test deletions via LLM-as-judge #1582 — impl-issue persona deleted a passing test instead of scoping it by build tag
• feat(webui): /preview/* phase A (build tag, fixtures only) #1585 — preview implementation generated panic() calls in init paths, failing forbidigo

Both rooted in cheapest-tier model lacking the nuance to refactor / scope / reason. Pipeline yamls had model: cheapest baked into many judgment steps as a cost optimization that no longer holds when output quality breaks downstream.

Change

Promoted to balanced on judgment steps; kept cheapest on summary/distill/format steps.

Pipeline	Step (was cheapest)	New model	Why
impl-issue	fetch-assess	balanced	issue assessment is judgment
impl-issue	agent_review	balanced	review is judgment
impl-issue	create-pr (commenter)	cheapest (kept)	PR body formatting = summary
impl-issue-core	fetch-assess	balanced	same as impl-issue
audit-tests	scan	balanced	finding extraction = judgment
audit-tests	report (summarizer)	cheapest (kept)	distill scan into report
audit-tests	agent_review	balanced	review is judgment
audit-architecture	scan + agent_review	balanced	same
audit-security	agent_review	balanced	review is judgment
audit-security	report (summarizer)	cheapest (kept)	distill
ops-bootstrap	commit (craftsman)	balanced	scaffolding code = judgment
ops-pr-review	diff-analysis	balanced	analysis = judgment
ops-pr-review	security llm_judge	balanced	judgment
ops-pr-review	quality agent_review	balanced	judgment
plan-research	analyze-topics + research-topics	balanced	research = judgment
plan-research	fetch-issue + post-comment	cheapest (kept)	data fetch + format

Other change

Added golangci-lint to flake.nix devShell so the same forbidigo gate that broke CI on PR #1585 runs locally without manual install. CI ships v2.10; nixpkgs-unstable ships v2.8.0 — minor skew, acceptable.

Test plan

• go build ./... clean
• go test ./internal/defaults/... passes (embedded-fs parity tests)
• nix develop -c which golangci-lint resolves
• Next dispatch (Phase 3 issues) uses these defaults — will validate via real run

Related

• Closes nothing directly. Blocks recurrence of impl-issue contract: reject net test deletions via LLM-as-judge #1582-style and feat(webui): /preview/* phase A (build tag, fixtures only) #1585-style regressions at the model-tier level.
• impl-issue contract: source_diff guard for test-file deletion ratio #1583, impl-issue contract: post-commit Test-count baseline check #1584 (sibling regression contracts) — defense-in-depth, complement this commit but ship independently.