feat: refresh default model provider runtime

[celia-oai]

Summary

• publish the process-default model provider as one atomically replaceable runtime snapshot
• refresh the snapshot after managed Bedrock login/logout and app-server config mutations
• make model listing, capability reads, default thread filtering, new threads, and the model refresh worker consume the current snapshot
• preserve explicitly configured per-thread providers

This is experimental follow-up 1/2 on the managed Bedrock auth stack.

Testing

• just test -p codex-core -E 'test(/refresh_default_model_provider_publishes_one_coherent_snapshot|new_threads_select_models_manager_for_their_effective_config/)'
• just test -p codex-app-server -E 'test(/external_agent_config_import_reports_failed_sync_import_in_completion|provider_runtime_refresh|models_refresh_worker/)'
• just fix -p codex-core
• just fix -p codex-app-server
• just fmt

Broader local package runs were also attempted. The app-server run passed 949/957 tests; the remaining failures were local plugin/network/zsh-fork harness failures. The core run was blocked broadly by missing auxiliary test binaries and sandbox/timing assumptions in this isolated worktree.