Model-currency follow-ups — finish models.yaml manifest + cron checker (rig-provisioned)

[alex-mextner]

From the ecosystem ROADMAP (§4). The daily-noon cron provisioning landed in rig-cli (PR #4, merged). These are the remaining model-currency follow-ups.

What

• models.yaml manifest: per-provider current model + capability tags (vision/code/reasoning) + role aliases (role vision resolves only to vision-capable models). Lives in agent-tools/lib (Python path, no contracts dir).
• Daily-noon cron checker that polls each provider's /models endpoint and opens a bump PR (semi-auto) when a newer current model appears.
• rig provisions the schedule (launchd/cron) and checks-and-installs-if-missing at init/apply — this part is DONE in rig (feat(rig): provision the model-freshness checker as a daily cron (#3685) #4).

Why

Hard-coded model ids go stale (e.g. the flat DEFAULT_MODELS Kimi/Fireworks staleness in review-cli). A manifest + a checker that proposes bumps keeps the whole ecosystem current via capabilities, not hand-edits.

Acceptance

• models.yaml manifest exists with per-provider current model + capability tags + role aliases.
• The cron checker polls provider /models and opens a semi-automatic bump PR on drift.
• Consumers (review board, task-cli classifier) resolve models from the manifest by capability.

Coordinates with the agent-tools shared-lib providers extraction (the manifest is consumed there).