agents: remove the hive-level /model control; the swarm editor sets the model

The per-agent web UI no longer sets the model: the `/model` slash
command, the model picker, `POST /api/model`, `Bus::set_model` and the
`hyperhive-model` writer are gone. The model chip is display-only and
shows where the model comes from (`model_source` in `/api/state`). The
model is set on the swarm (swarm UI agents page, `swarmctl agent
inference set`).

The read side is unchanged: with no swarm value an agent runs its
agent.nix model, else an existing `hyperhive-model` file, else haiku.
Existing files are not touched.

With the picker gone, its model list goes too: `available_models` in
`/api/state`, the ACP model-list filter, and the harness's global
`HIVE_AVAILABLE_MODELS`. The subagent daemon keeps its own
`HIVE_AVAILABLE_MODELS` from mcp.nix, and the `availableModels`
assertion stays.

`/effort` (command, picker, route, file) is unchanged.

Refs #5034

docs/agent-lifecycle/persistence.md

@@ -211,12 +211,12 @@ log row never blocks a rebuild.
 
 ### `/harness/hyperhive-model` (per agent)
 
-Single-line text file holding the claude model name currently
-selected for this agent (default `haiku` when absent). Written by
-`Bus::set_model` whenever the operator flips it via `/model
-<name>` in the web terminal. Read once at harness boot in
-`Bus::new`. Path overridable via `HYPERHIVE_MODEL_FILE`.
-Survives destroy/recreate, gone on `--purge`.
+Single-line text file holding a claude model name. The harness only
+reads it, at boot in `Bus::new` and again when the swarm clears the
+model it set. It holds the model the agent runs when neither the swarm nor
+`HIVE_DEFAULT_MODEL` (agent.nix) names one. Nothing in the harness
+writes it. Path overridable via `HYPERHIVE_MODEL_FILE`. Survives
+destroy/recreate, gone on `--purge`.
 
 ### `/harness/paused` (per agent)
 
@@ -313,7 +313,7 @@ Under `/var/lib/hyperhive/agents/<name>/`:
     tables above.
   - `hyperhive-events.sqlite` — turn-loop event log.
   - `hyperhive-turn-stats.sqlite` — per-turn timing stats.
-  - `hyperhive-model` — single-line model name override file.
+  - `hyperhive-model` — single-line model name file, read-only fallback.
 - `work/` — the agent's working space for git worktrees, build dirs
   and other large working data. Bind-mounted RW to
   `/agents/<name>/work` inside the container and owned by the agent