Display the provider alongside the model as "provider/model" in both
assistant footer and user header of the shared message component (used
by app web and desktop). Extracts a pure formatModelLabel helper with
per-field catalog fallback to raw providerID/modelID and a no-model
guard that never renders a stray slash.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Add Model.providerModel formatter returning "provider/model" with raw
providerID/modelID fallback on catalog miss, leaving Model.name intact.
Switch the session transcript header and the session view model label to
the new formatter. Existing transcript tests updated to the new format.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Address audit findings on the Task tool model override:
- treat the param as present when defined (model: "" now errors instead
  of silently inheriting the parent model)
- reject empty and prototype-polluting segments (__proto__, constructor,
  prototype) before any provider lookup, and catch defects so a crafted
  value never leaks a raw TypeError
- validate the model before creating the child subagent session, so an
  invalid model fails fast without spawning an orphan session
Adds tests for empty-string, prototype keys, multi-slash modelID, and
override-beats-agent-own-model.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

When the provider resolves but the model is unknown, render the provider
display name with the raw model id (provider/model), matching the shared
UI helper instead of falling back to raw IDs for both. Full miss still
yields raw providerID/modelID. Adds direct Model.name tests for the
retained helper.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Add tests for the partial-miss branch (provider known, model unknown) and
both branches of the no-model guard, and replace the brittle double-cast
fixture with a fully-typed one.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Replace the fixed denylist with a prototype-membership check
(segment in {}) so inherited Object.prototype member names such as
toString and valueOf cannot pass as a modelID against a valid provider
and spawn an orphan subagent session. Adds regression tests and
strengthens the empty-string assertion.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Note that the invoking agent can override the subagent model per call via
the Task tool's optional model parameter (provider/model form), and that
an invalid value fails with an Invalid task model error.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Split the single generic Task model error into format vs availability:
- malformed format (no slash, empty segment, prototype-chain key) keeps a
  "provider/model format" explanation
- a well-formed but unknown provider reports "provider ... is not
  configured"
- a known provider with an unknown model reports "model ... is not
  available for provider ..."
Availability errors surface getModel suggestions (Did you mean: ...),
discriminated by the typed ModelNotFoundError tag and Provider.list()
membership rather than message text.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Add cases for the empty/omitted suggestions branch (no dangling
Did you mean), pin the comma-join separator and order, cover the
single-suggestion no-comma path, guard the suggestion-presence loops
against vacuum, and assert the empty-string format echo.

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>

Distinguish the malformed-format Invalid task model error from the
well-formed-but-unavailable Model unavailable error (with suggestions).

Co-authored-by: yui-soul <yui-soul@users.noreply.github.com>