Session exit writes launch-time `model` back to settings.json, silently reverting edits (self-perpetuating stale default)

## Describe the bug

On exit, an interactive session writes its in-memory (launch-time) top-level `model` value back to `~/.copilot/settings.json`. If `settings.json` was changed after that session launched - by a manual edit, or by another session that is still open - the exiting session's write silently reverts the file to its own older value.

When the persisted `model` is one that is no longer in the account's catalog, this becomes a self-perpetuating loop: a clean launch falls back to the built-in default, and closing any older session re-writes the stale id back to disk, so hand-editing `settings.json` never sticks.

This is distinct from #4067 (model not applied on startup). Here the value IS applied on a clean startup; it is later clobbered on session exit.

## Affected version

1.0.75 (macOS, Darwin arm64)

## Steps to reproduce

1. Set `~/.copilot/settings.json` to `"model": ""` (any model; the loop is most visible if A is an id no longer in your catalog).
2. Launch session S1: run `copilot` (bare). It reads model A. Leave it open.
3. Edit `~/.copilot/settings.json` to `"model": ""` (a different valid model). Confirm the on-disk value is B.
4. Exit S1 (Ctrl-C twice, or `exit`).
5. Re-read `~/.copilot/settings.json`: the value has reverted to A. B is gone.

If A is not in the catalog, the startup log for step 2 shows:

```
[WARNING] Model '' from config file is unsupported or unknown. Falling back to default.
[INFO] Using default model:
```

The exit in step 4 rewrites `` (the launch-time value), not the resolved default, so the invalid id is preserved and the loop repeats on the next launch.

## Expected behavior

- Exiting a session should not overwrite `settings.json` with its launch-time model unless the user explicitly changed the model in that session (via `/model`).
- Edits made to `settings.json` while a session is open should not be silently discarded when that session exits.
- A `model` value that resolved to a fallback should not be re-persisted verbatim; persist the resolved model, or leave the file untouched.

## Impact

- Hand-editing `settings.json` to pin a default appears to "not work", because a lingering session overwrites it on exit.
- With a retired or unknown model id persisted, every new session silently downgrades to the default, and the file cannot be corrected while any older session is still alive.

## Workaround

Pass the model explicitly at launch so it does not depend on the file:

```
copilot --model --context --effort
```

A shell function wrapping `copilot` to always pass these flags is immune to the write-back.

## Additional context

- The `/model` picker also writes the top-level `model` and can reset `contextTier` / `effortLevel` to undefined, so using it interacts with the same persisted field.
- Related: #4067 (model not applied on startup), #3557 (contextTier not restored on startup), #1869 (model not persistent for future sessions).

Bắt đầu từ đường dẫn thoát phiên ghi model cấp cao nhất vào ~/.copilot/settings.json, sau đó so sánh với hành vi lưu bền của bộ chọn /model. Tái hiện chuỗi S1/edit/exit từ issue và xác minh rằng một phiên không thay đổi không còn loại bỏ các chỉnh sửa, trong khi một thay đổi /model rõ ràng vẫn lưu bền giá trị dự kiến.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.