[BUG-9] Silent model swap — LLM model changes without user notification

## BUG-9 — Silent Model Swap

**Category:** Bug — MCP Code | **Priority:** High

### Observation
The system silently swaps the active LLM model (e.g., fallback to a different model) without notifying the user or logging the substitution.

### Evidence
- Issue #643 — silent model swap observed

### Impact
Users receive responses from a different model than expected with no indication. This affects reproducibility, trust, and auditability of AI-generated content in compliance artifacts.

### Acceptance Criteria
- [ ] Model swap is logged with old model, new model, and reason
- [ ] If model swap occurs during a user-facing session, user is notified
- [ ] Compliance artifact generation records the exact model version used
- [ ] No silent fallbacks without explicit configuration