Accept repository-registered models in the quota recovery commands #395

Priority: P2. Follow-up to #389 / PR #392. No strict dependency; the operator recovery commands are unusable for this repository's own routing models until it is fixed.

Problem and rationale. scripts/quota_state.py (inspect and attest) validates the model with store._checked("model_requested", args.model) without passing repo_id. Telemetry._checked accepts repository-specific models only when called with repo_id (they are the models registered from that repository's profiles). Without it, only the global known set is accepted.

Observed on #330 / PR #384: quota_state.py … inspect --original codex --model openai/gpt-6.1-sol (and the bare gpt-6.1-sol, and codex:gpt-6.1-sol) is refused with 'model_requested' must name a model this toolkit knows. gpt-6.1-sol is this repository's deep_coder primary, so the operator cannot inspect or attest exactly the work that model produced. The same command with a globally known model such as gpt-6-luna succeeds, which confirms the cause. Using a different model to get past the check would attest false provenance, so the only honest workaround is to not use the command.

Objective and scope. inspect and attest accept the models of the repository named by --repo, and still refuse any name outside the global set plus that repository's registered models.

Smallest proposed implementation scope. Repository models are not persisted: Telemetry.add_known_models registers them in memory, per process, from the loaded .code-cycle.yml profiles (cycle.py does it at cycle start). So passing repo_id=args.repo alone would not fix the CLI, because a fresh quota_state.py process has registered nothing. The CLI must read the profiles of the repository configuration at --cwd (or fall back to the main worktree's, as run_cycle.py does), register their models with add_known_models(args.repo, models_from_profiles(profiles)), and then check the model with repo_id=args.repo. Check the other _checked("model_requested", …) call sites in the recovery path for the same omission. Document the accepted model names and the exact --model form in docs/routing.md ("Operator quota recovery"), which today does not say which form is expected. If the configuration cannot be read, the command stops with that reason instead of falling back to the global set silently.

Acceptance criteria.

• inspect and attest accept a model registered from the named repository's profiles, in the form the documentation states.
• A name that is neither globally known nor registered for that repository is still refused, and a credential-shaped string is never accepted.
• The refusal message names the accepted form.
• Telemetry stays free of prose, and the attestation guarantees of Route around recorded quota exhaustion and hand partial work to the fallback on resume #389 (single use, bound to scope and fingerprint, operator_attested) are unchanged.

Regression tests. A repository whose .code-cycle.yml profiles register a model that is not in the global set, run in a fresh process: inspect and attest accept it; an unregistered name and a credential-shaped string are refused; the global models still work.

Out of scope. Changing which models are globally known, and the attestation rules.