Persist per-agent model locations

[andy-xu-db]

🥞 Stacked PR

Use this link to review incremental changes.

• stack/codex/persist-model-location [Files changed] ← this PR
  • stack/codex/managed-model-location [Files changed]
    • stack/codex/claude-picker-ownership [Files changed]

---

Summary

• Persist ug configure --model-location <catalog>.<schema> independently for Claude Code and Codex and reuse saved locations on bare launches.
• Keep explicit provider/location choices launch-only and give them precedence over saved choices without mutating durable state.
• Enable Claude's pre-existing native gateway discovery only for an effective explicit/saved location, restore the caller environment afterward, and enforce the existing Claude minimum version before configuration or launch.
• Validate managed source policy before writes or workspace switches and isolate each managed agent overlay during multi-agent configuration.

Scope boundary

• Base: main. This begins a model-location/picker-safety stack independent of Define UG_ENABLE_MODEL_DISCOVERY policy #693/Control Claude scoped model discovery with UG_ENABLE_MODEL_DISCOVERY #672/Control Codex scoped model discovery with UG_ENABLE_MODEL_DISCOVERY #689.
• This stack does not define, read, or transport UG_ENABLE_MODEL_DISCOVERY; it uses only Claude's pre-existing native discovery flag so saved locations work independently.
• Refresh Claude model cache before scoped launches #622 is not an ancestor and is not part of this stack.

Verification

• Head: a0c7ed9adafca746774755266ddea29c5fb964ea.
• tests/test_cli.py at this boundary: 419 passed.
• Location-stack top: 2,540 passed and 42 skipped locally, excluding the native-binary capture test whose two environment-dependent failures reproduce on main.
• Ruff, formatting, and git diff --check passed.