[Bug] Subagent default model not covered by subscription kills all spawns with 401 — no fallback, resume cannot repair

Summary

When [secondary_model].default_model points at a model the current subscription does not entitle, every Agent/AgentSwarm spawn dies immediately with a 401, with no fallback, no config validation warning, and no way to repair the failed agents via resume (resume keeps the original broken model binding).

Environment

• Kimi Code CLI (managed kimi-code provider, OAuth login)
• macOS, config at ~/.kimi-code/config.toml
• default_model = "kimi-code/kimi-for-coding" (entitled, works)
• [secondary_model] default_model = "kimi-code/kimi-for-coding-highspeed" (provisioned by /login, not entitled on this tier)

Observed behavior

Every subagent spawn (no explicit model param) resolved to kimi-for-coding-highspeed and failed at mission start:

401 Your current subscription does not have access to kimi-for-coding-highspeed.
Upgrade to higher-tier Kimi Code plans.

• The main agent's model worked fine — only subagent spawns were affected.
• Nothing at session startup, config load, or spawn time warned that the configured subagent default was unreachable for this account.
• Spawning with explicit model: "primary" (or a pool alias on an entitled model) worked, confirming entitlement, not connectivity.
• AgentSwarm resume_agent_ids could not repair the failed agents: per the tool contract, resumed agents keep their original model, so resuming the 401-dead agents just re-failed with the same 401. The only recovery was discarding the failed agents and spawning fresh ones.

Expected behavior

1. Config-time or spawn-time validation: warn when [secondary_model].default_model (or a pool entry) resolves to a model the account cannot use — or at minimum, treat a 401 entitlement error as a signal to fail fast with a config-level hint, not a per-agent raw 401.
2. Graceful fallback: on a 401 entitlement failure for a pool-bound subagent, fall back to the caller's model (primary) or the next entitled pool entry instead of killing the agent. (Related: #3358 requests this fallback for 402/429 — 401 should be in the same class, and entitlement errors arguably shouldn't be retried at all per the loop_control docs' own reasoning for quota 429s.)
3. Repairable failures: either allow overriding the model when resuming a failed agent, or have AgentSwarm resume fall back to the current default when the original model binding provably failed with an entitlement error.

Why this matters for a paid product

The managed /login flow provisioned kimi-for-coding-highspeed as the subagent default, but this subscription tier doesn't include it — so a fresh, default install configuration silently breaks all multi-agent/swarm workflows. The failure surface is invisible until the first spawn, the error message doesn't identify the config key responsible, and the documented recovery path (resume) cannot fix it. These are exactly the "basic internal issues" that erode trust in a paid product: the config layer should never hand out a default the account can't run.

Suggested minimal fixes

• At config validation (kimi doctor) and session start: check each [secondary_model] pool alias against the entitled model list (available from the managed provider); warn loudly on mismatch.
• In the spawn resolver: if the resolved model returns a 401 entitlement error, retry the spawn once on primary before settling the agent as failed.

Start at the kimi doctor config-validation entry point, the spawn resolver, and AgentSwarm resume behavior described in the issue; reproduce the managed-provider 401 with an unentitled [secondary_model].default_model. Trace how entitlement failures are surfaced and how model bindings are retained on resume. Done should include a clear config or spawn-time diagnostic, the specified fallback or repair behavior, and coverage for the failed-spawn and resume cases.