fix: use agent-specific model config in allowlist validation

Fixes #4587

When an agent has a specific model configured via agents.list[].model,
the model was correctly resolved but then incorrectly validated against
the global model allowlist instead of the agent-specific config.

This caused the agent to fall back to the default model even when
a specific model was configured for that agent.

The fix ensures that buildAllowedModelSet uses the same modified config
(cfgForModelSelection) that includes the agent-specific model override,
rather than the original config.

Example config that was broken:
{
  "agents": {
    "list": [
      {
        "id": "researcher",
        "model": "anthropic/claude-opus-4-5"
      }
    ],
    "defaults": {
      "models": {
        "anthropic/claude-sonnet-4-5": { "alias": "sonnet" }
      }
    }
  }
}

Before: researcher agent would use sonnet (allowlist rejected opus)
After: researcher agent uses opus (allowlist includes agent-specific model)

src/commands/agent.ts

@@ -265,7 +265,7 @@ export async function agentCommand(
     if (needsModelCatalog) {
       modelCatalog = await loadModelCatalog({ config: cfg });
       const allowed = buildAllowedModelSet({
-        cfg,
+        cfg: cfgForModelSelection,
         catalog: modelCatalog,
         defaultProvider,
         defaultModel,