fix(supervise): preserve runtime-selected models

[drewstone]

What changed

• treat Eval's runtime-selected model marker as control data across router, cli-bridge, local CLI, sandbox, provider, authoring, and supervisor paths
• preserve provider-qualified AgentProfile model choices while preventing the marker from crossing execution wires
• send cli-bridge a bare harness id when a matrix cell delegates model choice, so Pi uses its configured Router model
• keep provider creation normalization out of the lean environment-provider import path
• release Runtime 0.123.1 with regenerated API and fixture artifacts

Why

A real Discovery smoke stopped before its first paid call because Eval correctly required a snapshot-bearing record identity while Runtime treated default as a literal bridge model. The fix keeps experiment identity separate from the concrete model selected by the execution backend.

Checks

• pnpm typecheck
• focused model/provider suites — 154 passed, then 37 passed after final hardening
• pnpm lint
• pnpm test
• pnpm docs:check
• pnpm check:version-bump
• pnpm verify:package
• DeepSeek V4 Flash through Pi/Tangle Router: APPROVE; final LOW finding fixed

[tangletools]

✅ Auto-approved drewstone PR — ac9a3ecc

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-08-03T04:48:11Z}