fix(model): default --provider switches to session-only persistence

[liuhao1024]

What does this PR do?

When /model is called with --provider but without --global or --session, the switch now defaults to session-only instead of persisting to config.yaml.

Before this change, /model sonnet --provider anthropic would overwrite model.default and model.provider in config.yaml, which is unexpected when the user is just trying a different provider for the current conversation. The --global flag still forces persistence when explicitly desired.

Related Issue

Fixes #58290

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/model_switch.py: Added explicit_provider parameter to resolve_persist_behavior(). When a provider is explicitly specified without --global/--session, returns False (session-only).
• gateway/slash_commands.py: Pass explicit_provider to resolve_persist_behavior() in the gateway /model handler.
• tui_gateway/server.py: Pass explicit_provider to resolve_persist_behavior() in the TUI /model handler.
• cli.py: Pass explicit_provider to resolve_persist_behavior() in the CLI /model handler.
• tests/hermes_cli/test_model_switch_persist_default.py: Added 4 test cases covering --provider flag behavior with and without --global/--session.

How to Test

1. Run pytest tests/hermes_cli/test_model_switch_persist_default.py -v — all 17 tests should pass.
2. In a gateway session, send /model sonnet --provider anthropic — the model should switch for this session only, and config.yaml should remain unchanged.
3. Send /model sonnet --provider anthropic --global — this should persist to config.yaml as before.
4. Send /model sonnet (no --provider) — this should persist to config.yaml (existing behavior unchanged).

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/hermes_cli/test_model_switch_persist_default.py -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 26.4.1

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[teknium1]

Thanks for tracing the behavior across CLI, gateway, and TUI.

Problems

• Current main intentionally treats /model as persist-by-default across all three surfaces: fad4b40d9d38573641c7f5de29fa4fc6f66e6d16 introduced --session as the opt-out, and hermes_cli/model_switch.py:416-443 still implements that shared contract. This PR makes an explicit provider a new exception, so the semantic change needs maintainer confirmation rather than being a mechanical bug fix.
• The new tests cover the resolver only. They do not prove the modified callers in cli.py:8069, gateway/slash_commands.py:1453, and tui_gateway/server.py:2882-2886 pass the provider value through.

Suggested changes

• Confirm the intended persistence contract for provider switches; existing --session and model.persist_switch_by_default already support explicit session-only operation.
• If the exception is approved, add caller-level coverage for CLI, gateway, and TUI/desktop, including --global precedence.

Automated hermes-sweeper review.

[teknium1]

Merged via PR #67946 — your commit from #58371 was cherry-picked onto current main with your authorship preserved in git log (rebase merge). The session-only default you built for --provider switches is now the default for ALL /model switches on every surface, so this PR's gateway-specific half is covered by the same root fix. Thanks for the clean fix and the tests — they shipped with your name on them.