fix(tui): retain unavailable saved session model selection - #53822

Why

When an existing session's saved model is temporarily missing from the model catalog (for example while a remote provider catalog is reloading or unreachable), sessionSelection filters out the saved selection with isModelValid and falls through to newSessionModel(). If the user submits a prompt during that window, the TUI commits a durable model-switched record to the session, permanently replacing the session's model with the fallback even after the original catalog recovers.

What Changes

Existing sessions retain their saved or session-agent model selection (and variant) even when the model is not currently present in models(). New-session fallback resolution (args.model, configured default, and preferences.recent) still skips unavailable models.

• Before: Opening or submitting in an existing session whose model provider/model-a is temporarily absent selects the first available fallback provider/fallback, reports available() === true, and writes a durable model-switched event on submit.
• After: The session retains provider/model-a with its saved variant, available() returns false, and the prompt submit guard blocks with Model unavailable instead of switching the session's model.

flowchart TD
    A[Resolve sessionSelection] --> B{Draft or durable session model exists?}
    B -- Yes --> C[Retain saved model and variant]
    C --> D{Present in models catalog?}
    D -- Yes --> E[available = true, submit allowed]
    D -- No --> F[available = false, submit blocked with Model unavailable]
    B -- No --> G[Fallback to newSessionModel via isModelValid]

Demo

Scope

This PR owns existing-session model retention in packages/tui/src/context/local.tsx. Remote configuration caching and cold-start discovery recovery live in separate packages/core PRs.

Verification

cd packages/tui
bun run test test/context/local-selection.test.tsx
bun typecheck

• test/context/local-selection.test.tsx: 9 tests pass (27 assertions), covering retained unavailable session selections alongside the newSessionModel validity filter for CLI and recent models.
• End-to-end opencode-drive verification confirmed that submitting a prompt during a remote catalog 503 outage no longer appends a model-switched event and preserves the session's original model once the catalog recovers.