fix(coding-agent): skip context-incompatible fallbacks

[DEV-PROLL]

Summary

• preflight retry-fallback candidates against the live conversation budget and continue past incompatible rungs
• make automatic fallback model changes transactional so rejected switches leave no persisted model change or stale prompt/tool state
• expose a bounded, non-blocking typed retry_fallback_exhausted extension event for fresh-context recovery

Verification

• 8 focused fallback/model-budget/RPC suites: 54 tests passed
• npm run check
• isolated mock-loop budget exhaustion QA with zero provider calls
• RPC and xterm.js TUI fallback QA

Evidence

• local-ignore/qa-evidence/20260904-context-fallback/README.md (local reviewer artifact; not committed)

No real provider credentials or paid calls were used.

---

Summary by cubic

Fixes retry fallback so it skips context-incompatible model rungs and only settles when no remaining rung can hold the live conversation. Automatic fallback model switches are now transactional — a rejected switch leaves no persisted model change or stale prompt/tool state, and a failed fallback settles the retry lifecycle instead of wedging prompt().

What changed

• Fallback preflights each candidate against the live context budget and skips incompatible rungs instead of switching onto a model that can't hold the conversation.
• Automatic fallback switches commit only after the post-model_select budget check passes; on rejection, session state is restored and nothing is persisted. Persistence is the commit boundary — SessionManager persists before exposing an in-memory entry, initial session files are written atomically, and failed appends truncate back.
• Retry handling and observers are failure-isolated: a throwing session or extension listener can't block settlement, post-commit observer failures still record the applied rung, and any internal retry-handler failure resolves the retry instead of wedging prompt().
• New retry_fallback_exhausted extension event exposes diagnostics (sessionId, chainKey, from, lastError, exhaustionReason, rejectedCandidates) so an extension can route work to a fresh context; it is notification-only, never blocks retry settlement, and its payload truncates each string field and candidate error to stay under 64 KiB of serialized UTF-8.

^{Written for commit d3dab96. Summary will update on new commits.}

[DEV-PROLL]

@code-yeongyu This is ready to merge. All repository checks are green; independent code and security reviews both passed; npm run check passed; the focused fallback/session regression set passed (13 files, 144 tests); isolated mock-loop/RPC/TUI evidence used no provider credentials or paid calls. The authenticated PR author account has read-only permission on the upstream repository, so it cannot enable auto-merge or satisfy the base-branch merge policy itself. Please approve and merge when available.

[DEV-PROLL]

@code-yeongyu Update: this branch now includes current main (5c4c1702d) at head d3dab962b. The post-merge focused fallback suite and full bun run check are green, and the PR is GitHub-mergeable. The dependent OMO PR code/review/QA is also green and is waiting for this Senpi release before updating its pin. Please merge and publish when available.