hive-runtime, hive-agent: model/effort picker for ACP agents from configOptions

An ACP agent's model and effort pickers now list what its session offers
(its `model` and `thought_level` config options) instead of the claude
model list and EFFORT_LEVELS. A pick goes through the same Bus::set_model /
Bus::set_effort -> Config.model / Config.effort path as on claude; before
each prompt the ACP runtime sets it with `session/set_config_option`, model
first, and only when the session offers that value. Options are re-read
from the set response and from `config_option_update`, so the effort picker
disappears when the chosen model offers no effort levels, and is hidden
while a newly picked model waits for the next turn.

The session's options reach the web UI through a `Choices` handle from a
new `Runtime::choices`, registered on the bus the way `canceller` is.
/api/model and /api/effort accept only offered values on ACP. The claude
path is unchanged.

Refs #4391

docs/tools/subagent.md

@@ -307,8 +307,9 @@ On `acp`:
   system prompt.
 - `interrupt` sends `session/cancel`, and `force` changes nothing. The
   runtime kills an agent that ignores the cancel for 10s.
-- `model` and `effort` do nothing: the agent runs the model it's
-  configured with.
+- the runtime sets `model` and `effort` on the session when the agent
+  offers that value for its `model` or `thought_level` config option. Any
+  other value does nothing (`hive_runtime::AcpRuntime`).
 - the agent's permission requests get the same answers a claude subagent's
   tool list gives: MCP tools and file tools, `fetch` with `web_tools`,
   `execute` with `execution` (`session::acp_permits`).

docs/web-ui/agent.md

@@ -61,6 +61,11 @@ structurally rather than for one specific trigger. Two columns:
     display) this rewrite exists to fix.
   - **Effort badge** (`effort · <level> ▾`): same shape, `/api/effort`,
     shown when `state.available_efforts` is non-empty.
+  - On an ACP agent both pickers list what its session offers (its
+    `model` and `thought_level` config options), and are empty until the
+    first turn has attached a session. The effort picker is hidden when the
+    model offers no effort levels, and while a newly picked model waits for
+    the next turn, since the levels come with the model.
   - **Ctx / cost badges**: `ctx · 142k` (last inference's prompt size,
     tooltip shows % of context window) / `cost · 1.3M` (cumulative
     tokens billed across every inference in the last turn).
@@ -303,6 +308,9 @@ shaped).
   rejected rather than forwarded to `claude --effort`. Persists via
   `Bus::set_effort`, which emits `EffortChanged`. Applies on the next
   session start (no mid-session swap).
+- On an ACP agent, `/api/model` and `/api/effort` accept only values the
+  session offers, and the runtime sets them with `session/set_config_option`
+  before the next prompt.
 - `POST /api/new-session` — arm a one-shot for the next turn to
   drop `--continue`. Emits a `LiveEvent::Note`.
 - `POST /api/logout` — three-step teardown that re-uses the