[Feature] Subagents: per-invocation model override on the Agent tool (no session restart)

摘要： 子代理的模型只能在定义文件或设置页中指定，且修改后必须新建会话才生效；Agent 工具调用时无法按次覆盖模型。建议 Agent 工具增加可选 model 参数（如 <provider>/<model>），仅在本次调用生效，并支持定义文件热加载。参考 Claude Code Agent 工具的 model 参数与 Codex CLI 的 exec -m。

Problem: Subagent model selection is definition-level only. Changing a subagent's model — whether by editing its .md definition file or via the Settings page — requires starting a new session; running sessions don't hot-update. There is no way to select a model at spawn time.

Why it matters: The orchestrator-plus-cheap-worker split is how every serious harness does volume routing now. Claude Code's Agent tool takes a model argument per call; Codex CLI takes -m per invocation. ZCode is Codex-lineage but currently turns what is a parameter elsewhere into a ceremony here: one definition file per model, plus a session restart, every time you want a new model/role combination.

Concrete use case: Lead session on GLM-5.3 orchestrates; high-volume drafting and mechanical work is delegated to a secondary provider (custom OpenAI-compatible provider, e.g. Xiaomi MiMo). Today this requires pre-registering one agent definition per model and restarting the session whenever the roster changes — and since unrecognized frontmatter fields are silently ignored, attempts to pin a model per call simply vanish without an error, which makes the limitation hard to even discover.

Request:

1. Agent tool accepts an optional model argument (<provider>/<model>) that overrides the definition's model for that invocation only.
2. Ideally: agent-definition changes (new files, model edits) hot-register into running sessions.

Related: #299 (planner + cheap-model executors), #301 (nested subagent spawning)

Start at the Agent tool invocation path and the agent-definition loading used by the Settings page; trace how the definition's model is resolved for each spawn. Done means an optional provider/model override applies only to that call, definition changes are reflected in running sessions if hot loading is included, and tests cover both behaviors.