Model picker stuck on auto: app-spawned CLI engine fails auth (401 Bad credentials) -> 0 models, then serves stale single-model cache

## Summary

The model picker in the GitHub Copilot desktop app shows **only `auto`** — no other models are ever listed. Before a PC restart, the same underlying condition surfaced as visible "API errors" in the app instead. After the restart, the app silently falls back to a single `auto` entry and stays that way for the entire session.

Digging through the logs in `~/.copilot/logs/`, the root cause is that **every CLI engine process the app spawns fails an auth check with `401 Bad credentials`, which makes the models endpoint return `0 models`. The app then caches a single-model fallback process-wide and never refreshes it.**

## Environment

- App version: **1.0.15**
- Bundled Copilot CLI engine: **1.0.69-0**
- OS: Windows
- Enterprise Copilot backend (`api.enterprise.githubcopilot.com`)

## Evidence from logs

1. On launch, **every** app-spawned CLI engine process fails the same auth check:

```
[ERROR] runtime::auth_manager_orchestration: Failed to fetch PAT user login (401): GitHub returned: Bad credentials
```

This repeated across ~16 spawned processes in a single launch.

2. As a direct consequence, the model list comes back empty:

```
[DEBUG] Successfully listed 0 models
```

3. The app then serves a single-model fallback from a process-wide cache, and keeps serving the stale value on every session resume — it never re-fetches:

```
github_app::session::manager::state: served session CLI models from process-wide cache model_count=1 age_ms=13168
...
github_app::session::manager::state: served session CLI models from process-wide cache model_count=1 (context="session resume")
```

Notably, a **fresh interactive CLI session on the same machine successfully listed 15–34 models** at the same time the app-spawned processes were getting `0`. So the credential the app's engine uses appears to be stale/different from what a fresh sign-in produces. The rest of the GitHub session was healthy (repo search, cached `api.github.com` GETs, and `gh` all worked) — only the Copilot engine's PAT/token auth was rejected.

## Impact

- Model picker is stuck on `auto`; user cannot select any model.
- The condition persists across restarts because the invalid stored token keeps triggering the startup `401`.

## Suspected bugs (independent of the credential itself)

1. **No cache invalidation / re-fetch after an auth failure.** The app caches `model_count=1` at warm-up and serves it for the whole session even if auth could later succeed. There's no retry/refresh once credentials are valid.
2. **Poor error surfacing.** A `401 Bad credentials` is presented to the user only as "the model list shows just `auto`", with no indication that re-authentication is required. (Pre-restart the same condition showed up as generic "API errors".)
3. **Signing out/in does not clear the bad credential.** The invalid token persists in the OS credential store across a normal sign-out/sign-in, so the in-app re-auth flow does not recover from this state.

## Expected behavior

- When the model fetch fails due to auth, surface a clear "sign-in expired / please re-authenticate" state instead of silently falling back to `auto`.
- Re-validate/refresh the model list (and invalidate the cached fallback) once valid credentials are available, without requiring a manual app restart.
- The in-app sign-out/sign-in flow should fully clear and replace the stored CLI credential.

## Workaround that resolved it locally

Signing out and back in through the app did **not** fix it. What worked was **manually deleting the stored Windows Credential Manager entry for the CLI** (service `copilot-cli`) and then re-authenticating, which forced a fresh, valid token and restored the full model list.

---

## Update: a second, separate recurrence (staff-mode feature)

The issue came back later the same day, but with a **different root cause** than the bad-credential case above — same visible symptom (model picker stuck on `auto`).

This time a **staff-mode feature** routed the Copilot engine through an internal wrapper. That wrapper crashed the engine within ~1 second on every spawn, so **every** engine-backed request failed with `request cancelled` (model listing, account quota, global agents, session creation, CLI pre-warm) — leaving only `auto` in the picker.

Disabling that staff-mode feature immediately stopped the crash loop and restored normal behavior (a full relaunch is recommended afterward so the model list re-fetches cleanly).

**For maintainers:** the recurrence is tied to a staff-mode feature, so the deeper details and debugging info aren't appropriate to post publicly here. Please **reach out on Teams for the staff-mode specifics and debugging logs.**