[AIGTWY-4901] Only remove a Codex model ug wrote

[david-siqi-liu]

Codex's writer removed model and model_reasoning_effort from ~/.codex/ucode.config.toml and /etc/codex/managed_config.toml whenever ug had no managed default to pin, on every configure, launch, and state load.

Before / after

• Before: ug removed the Codex model (and model_reasoning_effort) by name whenever it had no managed default, so a model the developer or an admin chose was deleted.

• After: ug removes or restores model only when the destination file's provenance record shows ug wrote the current value. A developer-set model survives, model_reasoning_effort is never touched, and a model ug pinned for a prior workspace or managed default is still retired once the file has a record (or, for the managed file, a last-applied snapshot).

• model is removed, or restored to its pre-ug value, only when the destination file's provenance record shows ug wrote the current value and nobody changed it since. A model ug pinned for a previous workspace or managed default is still retired, on configure and on launch.

• model_reasoning_effort is never removed; ug never writes it.

• default_model() only reads (that part already landed on its own in [AIGTWY-4881] Keep Codex's managed default model when ug saves state #1010). Launch still retires a model ug pinned, and forgets ownership of a model the developer has since changed.

• Ownership is recorded after a confirmed write only. A value either file already held is not adopted unless ug's record (or, for the managed file before the record existed, its last-applied snapshot) shows ug wrote it, a managed config that was already up to date adopts nothing new, and ug no longer backs up its own generated file as if it predated ug after a workspace switch.

• For a managed config ug wrote before the record existed, ownership of model is bootstrapped from ug's last-applied snapshot, so an upgrading user's stale pin is still retired. A private config without a record keeps any model it has.

• Smart routing keeps its existing behavior.

This pull request and its description were written by Isaac.

[github-actions]

UG review

Reviewed Codex model ownership across configure, launch, and migration from managed-file snapshots. The migration can mistake a preserved admin model for a ug-owned pin.

Blocker

• Avoid adopting inherited models from snapshots — src/ucode/agents/codex.py:651: can we distinguish generated pins from inherited snapshot values? an admin model added after the original backup and preserved by smart routing will be deleted when routing is disabled.

Automated advisory review of 1912551900f9 using Lilly's UG review rubric. It does not approve or block this PR.

[david-siqi-liu]

Blocker (adopting a matching developer model on the first recorded write): fixed in e7733f2. The private-file write now always compares against the file as it was before the write, so a model the developer already had is never claimed just because it equals the managed default, and stays when the default is removed. Added test_first_recorded_write_does_not_adopt_a_matching_developer_model, which fails on the old code. (The managed file already worked this way.)

[david-siqi-liu]

Blocker (bootstrap adopting an admin model preserved in the last-applied snapshot): leaving as is. This only applies to the one-time upgrade bootstrap of a managed file that has no provenance record yet. Today's main removes the Codex model by name on every run whenever there is no managed default and smart routing is off, in both files, so that admin model is already deleted on main. With this PR it can happen at most once, on the first upgraded run, and never again once the record exists. Dropping the bootstrap would instead strand every upgrader's own stale ug pin, which is the reason the bootstrap exists.