fix(desktop): let explicit model switches escape broken config providers (#42241)

[rodboev]

Summary

Hermes Desktop could get trapped on a default config.yaml provider that had no API key: new sessions failed immediately, and the in-session model picker still surfaced the same stale provider error even when the user explicitly picked a working model from a different provider. This PR makes the Desktop switch path honor the requested provider/model pair instead of re-failing on the broken config default.

What Changed

• Desktop in-session model picker: send explicit provider/model changes through the gateway config switch path instead of the slash command bridge
• Gateway model switch path: when a session has no live agent yet, honor an explicit --provider choice instead of bootstrapping the broken default provider first
• Regression coverage: reproduce a missing-key config default, verify an explicit provider switch succeeds, and verify selected-provider credential errors surface directly

Why It Matters

Desktop users need a GUI-only recovery path when a stale or hand-edited config points at a broken provider. The model picker should be that escape hatch, not another place where the old config lock is re-applied.

Verification

npm --workspace apps/desktop run test:ui -- src/app/session/hooks/use-model-controls.test.tsx
D:\Repos\hermes-agent\venv\Scripts\python.exe -m pytest tests\test_tui_gateway_server.py -k "config_set_model_explicit_provider or config_set_model_global_persists" -v --timeout=0

Upstream

Closes #42241.
Reported by @stephenlzc.

[liuhao1024]

Verification Review

Reviewed: Clean fix for a real user-facing bug in the desktop model picker.

Problem: When the default provider in config has no API key (or is broken), the desktop model picker's slash.exec /model path initializes the broken provider first — causing the switch to fail even when the user explicitly selects a working provider.

Fix: Routes active-session model changes through config.set (key=model, value=model --provider provider) instead of slash.exec /model. This sets the model override on the session without initializing the default provider.

Test coverage: Two tests in test_tui_gateway_server.py verifying (1) the broken default provider is never initialized when an explicit provider is given, and (2) errors from the selected provider are surfaced correctly. Frontend tests in use-model-controls.test.tsx verify the config.set routing.

No issues found.

[austinpickett]

Merged into main via #46796 (commit ed20f5e). Your fix was salvaged onto current main with your authorship preserved — explicit model switches now escape a broken config default provider: config.set pre-parses the model flags and, when an explicit --provider is given and no agent exists yet, skips the default-provider agent build and routes straight through _apply_model_switch with the explicit provider. The desktop hook sends config.set instead of slash.exec so selected-provider errors surface to the user.

During salvage I resolved one conflict — main had added a pin_session_override param to _apply_model_switch since your branch, so I kept both that and your parsed_flags passthrough — and dropped the no-op lockfile churn. All 20 model-switch tests pass.

Thanks @rodboev! 🙏 (Fixes #42241.)