fix: choose supported model when recovering after account switch

[ege-arhan]

Problem

After an automatic account switch, a desktop thread resumed with gpt-6-sol inherited from the thread or ~/.codex/config.toml. The new ChatGPT account rejected that model with HTTP 400. A successful turn/start response did not mean the generated turn succeeded.

Change

• Query the new account's model/list before starting desktop continuation. Keep the thread model if listed; otherwise use the account's advertised default model.
• Relaunch CLI recovery with the account's default model via --model, so an unsupported global model cannot break it. Start a fresh terminal process at each account handoff instead of reusing a runner with a stale model.
• Leave the user's global Codex configuration unchanged.

Verification

• Reproduced the mismatch from a real rollout: the previous turn used gpt-6-sol; model/list on the switched ChatGPT account omitted it and marked gpt-6-astra as default.
• cargo test --manifest-path src-tauri/Cargo.toml auto_recovery --lib: 26 passed.
• Built and installed the macOS app bundle; the main window opens normally.

The next live limit handoff remains the end-to-end check for this failure path.