hive-runtime, hive-agent: model/effort picker for ACP agents from configOptions

An ACP agent's model and effort pickers now list what its session offers
(its `model` and `thought_level` config options) instead of the claude
model list and EFFORT_LEVELS. A pick goes through the same Bus::set_model /
Bus::set_effort -> Config.model / Config.effort path as on claude; before
each prompt the ACP runtime sets it with `session/set_config_option`, model
first, and only when the session offers that value. Options are re-read
from the set response and from `config_option_update`, so the effort picker
disappears when the chosen model offers no effort levels, and is hidden
while a newly picked model waits for the next turn.

The session's options reach the web UI through a `Choices` handle from a
new `Runtime::choices`, registered on the bus the way `canceller` is.
/api/model and /api/effort accept only offered values on ACP. The claude
path is unchanged.

Refs #4391

hive-agent/src/events.rs

@@ -335,6 +335,11 @@ pub struct Bus {
     /// by the serve loop when it builds the session; unset on claude, whose
     /// turn `/api/cancel` stops by signalling the `claude` process.
     turn_canceller: Arc<OnceLock<hive_runtime::Canceller>>,
+    /// The model and effort the session offers, for a runtime that reads them
+    /// from its session (ACP). Set once by the serve loop when it builds the
+    /// session; unset on claude, whose pickers list the configured models and
+    /// `EFFORT_LEVELS`.
+    session_choices: Arc<OnceLock<hive_runtime::Choices>>,
     /// Current fresh-claude-session id (FK to `sessions.id`). Set by the
     /// bin loop after minting a session row on a fresh start; stamped onto
     /// every `turn_stats` row until the next fresh session. `None` before
@@ -427,6 +432,7 @@ impl Bus {
             compact_pending: Arc::new(Mutex::new(None)),
             post_compact_wake: Arc::new(Mutex::new(None)),
             turn_canceller: Arc::default(),
+            session_choices: Arc::default(),
             session_id: Arc::new(Mutex::new(None)),
             fresh_session: Arc::new(AtomicBool::new(false)),
             tool_calls: Arc::new(Mutex::new(std::collections::HashMap::new())),
@@ -463,6 +469,19 @@ impl Bus {
         self.turn_canceller.get()
     }
 
+    /// Record where the session's model and effort choices are read. Only the
+    /// first call takes effect; there is one session per harness.
+    pub fn set_session_choices(&self, choices: hive_runtime::Choices) {
+        let _ = self.session_choices.set(choices);
+    }
+
+    /// Where the session's model and effort choices are read, if the runtime
+    /// offers them (see [`Self::set_session_choices`]).
+    #[must_use]
+    pub fn session_choices(&self) -> Option<&hive_runtime::Choices> {
+        self.session_choices.get()
+    }
+
     /// Request a session reset (operator `POST /api/new-session`). Deferred:
     /// the flag is consumed at the next turn boundary by `drive_turn`, which
     /// archives the current session so no claude process is mid-write when the