Roles: re-point reused Sessions when a role model drifts

A role model only seeded brand-new Sessions, so Workers created before a settings change kept their old route forever — the operator's complaint that the default model 'did not take effect'. On dispatch, ensure() now compares the durable selection or header of an existing Session against the configured role model and appends a model/selection event when they drift, leaving the deployment default alone. Seven unit cases cover drift, idempotence, effort, and precedence.

src/app/sessions.ts

@@ -13,7 +13,7 @@ import { AgentDelivery, messageId } from './delivery.ts'
 import type { Effects } from './effects.ts'
 import type { Variable } from './execution-environment.ts'
 import { RetryHealth } from './retry-health.ts'
-import { initializeRoleModel } from './role-models.ts'
+import { alignRoleModel, initializeRoleModel } from './role-models.ts'
 import { bundledSkills } from './skill-files.ts'
 import { SKILL_PREFIX, type PromptVersion, type Prompts } from './prompts.ts'
 import type { Store } from './store.ts'
@@ -157,7 +157,9 @@ export class Sessions {
     }
     if ('error' in result) throw result.error
     const settings = this.host.store.settings()
-    await initializeRoleModel(ctx, result.agent, role === 'orchestrator' ? settings.eval.model : settings.executor.model)
+    const roleModel = role === 'orchestrator' ? settings.eval.model : settings.executor.model
+    await initializeRoleModel(ctx, result.agent, roleModel)
+    if (!created) await alignRoleModel(ctx, result.agent, roleModel)
     await this.decorate(result.agent)
     ctx.permissionPresets.set(result.agent.session, 'danger-full-access')
     await ctx.sessionController.rename({ sessionId: id as SessionId, title })