fix(codex): hot-reload quota model exclusions

[wangmou20]

Summary

• publish quota-derived per-account model exclusions through the existing runtime state file instead of rewriting auth JSON during quota refresh
• hot-reload exclusion changes into selectors, registry, and scheduler when the embedded sidecar runs via StartRuntime
• fail closed for incomplete account snapshots, while allowing a complete snapshot to clear stale Spark exclusions without restarting the sidecar
• preserve unrelated model cooldown/suspension state and remove aliases whose canonical source is excluded
• make auth-file refreshes atomic and keep watcher updates manifest-aware

Problem

When Spark quota recovered, Cockpit refreshed the account quota but left the old excluded_models routing state in the running sidecar. Spark workers then continued receiving 503 auth_not_found: no auth available until the sidecar account set was manually reloaded. The embedded StartRuntime path also did not start the auth watcher.

Design

quota-reserve.json now carries an authoritative modelExclusions array for every effective account. Explicit [] means allowed; missing/null state fails closed when a runtime-state path is configured. Rust quota refreshes update this state atomically and do not rewrite auth JSON for model-exclusion changes.

If any effective account snapshot is missing or unreadable, all effective accounts receive *; only a later complete snapshot may remove that temporary block. Go reloads only accounts whose exclusion semantics changed, and uses a preserving registry reconciliation so a Spark policy change does not clear Luna/Terra cooldowns.

Verification

• Cockpit sidecar regression tests: repeated 20–50 times
• relevant Go race tests: repeated 3–10 times
• touched vendored packages: internal/registry, sdk/auth, sdk/cliproxy, sdk/cliproxy/auth, and internal/watcher all pass
• Windows amd64 sdk/auth cross-compilation passes
• cargo check -p cockpit-tools --tests passes
• git diff --check and gofmt -d are clean

Known unrelated local baseline failures remain outside this patch: TestAuthHookEmitsRequestScopedResultDiagnostics in the sidecar main package, plus Antigravity Claude signature tests when the local signature cache is disabled. Rust test linking is unavailable on this host because GTK/WebKit development libraries are not installed; test code is covered by cargo check --tests.

No production sidecar was replaced or restarted for this PR.