fix(desktop): recover backend lifecycle and retain admitted model selection

[Sailfishc]

Fixes desktop exit/recovery and remembers the last admitted main-conversation model and reasoning effort for new conversations. Normal connected status no longer occupies the header; actionable stopped, uncertain and update states remain visible.

The lifecycle repair checks original Desktop/Core identity, generation and cleanup before retiring a partially stopped legacy manager. Explicit interface-only exit keeps work running; stop-and-exit waits for lifecycle settlement. Interrupted deployment updates remain inspectable and can resume without replaying uncertain operations.

Core captures model preference in the same persisted snapshot as explicit user submission receipts. Duplicate receipt reads, queue execution, Side/child/background work, unsent edits and history navigation cannot advance it. The desktop backend serializes cross-project updates and persists the accepted preference. Model availability/effort fallback is visible, while explicit Profile models retain priority. State format is now 15 and reads formats 1–15, including backward compatibility with 1–14; rollback requires a pre-upgrade backup. API/schema and paired user documentation are updated.

Prepares CLI 0.1.6 and GUI 0.1.11. CLI remains ad-hoc signed on macOS arm64 with a Linux x86_64 bundle; GUI uses Developer ID/notarization. Final release tags will be created only from the merged upstream main commit, after local package/native/provider/upgrade acceptance. No previously published tag or asset is replaced.

The PR includes the prior Core resource-alias signing repair. Fresh signing runs check Core hashes before Apple upload. This release will use a new signing directory and final hash verification; legacy interrupted phase=signed resume hardening remains a recorded follow-up.

Validation so far: submitted changes first, then format checks, both SDK suites and script tests passed (98 Python tests, 2 Linux-container-only skips). Local GUI/type checks and renderer build passed (86 tests passed, 3 opt-in native checks skipped). The first sandboxed GUI attempt failed on localhost listen EPERM; unchanged tests passed with host execution permission. Initial Linux CI exposed five tests still expecting format 14; the format assertions now require 15, and legacy migration adds a format-14 input while keeping unknown-role and version-13 Side refusal checks unchanged. Original failures are retained; A subsequent Verify run exposed a Store-owner handoff failure during plugin reopen and ENOENT during launcher-killed status. The lifecycle fix at 8e6d2b2 adds bounded exclusive-lock handoff before any session cleanup, and reports only known control-endpoint disconnects as unavailable without inventing a clean-stop receipt. Active/unreachable owners cannot be replaced by ensure; protocol/permission/timeout errors remain failures. A controlled pre-exec inherited-FD negative test fails on the prior immediate-lock path and passes after restoration; active-owner preservation and all 19 local-service unit/native-process checks pass. The original Linux CI did not retain the lock-holder PID, so this mechanism is not claimed as its uniquely established cause. Full CI and the original integration paths are being rerun. After CI/review, this PR is authorized to leave draft and merge; final Mac packaging/acceptance happens from merged main. No administrative protection override or force push will be used.

Mechanism scope: lifecycle ownership/recovery and explicit user model configuration, not benchmark-specific execution policy or default resource budgets. These regressions establish correctness, not aggregate Agent capability or performance gains. No new design documents, ADRs, prototypes, private configuration, credentials or private test evidence are included.

Exact head 8e6d2b26d28c3d8499abb79ab92e6d68275228c0 completed all applicable CI successfully: Verify, GUI checks, both release bundles/installations, and provider fixtures. Linux portable logged 975 Rust tests passed and14 ignored; macOS native reran the original shared-service crash path successfully. Local exact-head format/SDK/script checks and native shared-service fault smoke also pass.