fix: fail loud instead of silently swapping models on an unresolvable pin (#137)

* fix: fail loud instead of silently swapping models on an unresolvable pin

agent()'s model resolution had two stacked gaps: an unresolvable model spec
(e.g. a bare aggregator-style id like "moonshotai/kimi-k3" whose vendor
segment collides with a real, separately-registered provider name) silently
fell back to the session default with only a console.warn, and the resolver
itself lacked pi CLI's auth-aware preference for an authenticated raw-id
match over an unauthenticated same-named provider.

Now an unresolvable model/tier spec throws a clear MODEL_NOT_FOUND error
before the subagent session is even created, instead of quietly running
against a different (possibly unauthenticated) model. resolveModelSpecWithThinking
also gained the missing auth-preference check, cross-verified against
pi-coding-agent's own resolveCliModel via a fuzzed property test so future
drift between the two is caught immediately.

Closes #131.

* fix: distinguish explicit model/tier pins from the implicit default tier

An explicit model or tier pin that resolves to an unavailable model now
throws MODEL_NOT_FOUND naming its source (e.g. which tier, and what it
resolved to), matching the existing explicit-model behavior. An untagged
agent routed only through the implicit default "medium" tier never asked
for that specific model, so it still degrades to the session default when
unavailable — but the degrade now fires a run-visible log event instead of
being silent, and only once per run.

Also strengthens the model-spec parity property test so it actually
exercises the auth-preference branch against pi-coding-agent's real
resolveCliModel (the previous fuzz domain never triggered it), and updates
the workflow-authoring skill references and generated capability facts that
still described the old blanket fallback.