fix(gateway): thread session overrides through Bot Chat capability rebuild

[pierrenode]

What

tui_gateway/server.py::_sync_bot_capabilities() rebuilds a Bot Chat session's agent in place whenever its capability surface changes (skill install, MCP toggle, SOUL edit). It does so via a bare call:

new_agent = _make_agent(
    sid,
    session["session_key"],
    session_id=session["session_key"],
    platform_override=_session_source(session),
)

Unlike _make_agent's other caller (the initial session-build path, which threads current.get("model_override") / create_reasoning_override / create_service_tier_override into the kwargs), this rebuild never passes them — so _make_agent falls back to the global config default for the model, reasoning effort, and service tier.

Why it matters

Bot Mode's own premise is that each bot keeps its own model. Concretely: pin a bot to a specific model via /model X (persisted as session["model_override"]), then install a skill or toggle an MCP server for that bot later — the very next turn silently reverts it to the config-default model. No error, just a generic "Capabilities updated — this bot's tools and prompt were refreshed." notice.

Second, related gap: the /model --once race

Two lines above the _sync_bot_capabilities call, _apply_pending_model_switch/_sync_agent_model_with_config are already wrapped in if not one_turn_restore:, with a comment citing #29923: a /model --once turn mutates the live agent object in place and schedules a post-turn restore, so a same-turn rebuild must not run or it clobbers the in-place switch. _sync_bot_capabilities sat outside that guard, so a capability-triggered rebuild landing during a pending once-restore replaces the agent object outright — discarding the once-switch, and (per the mutation-verify run below) handing the turn to a brand-new agent object.

Fix

• Thread model_override / reasoning_config_override / service_tier_override from the session dict into _sync_bot_capabilities's _make_agent call, mirroring the initial-build caller.
• Move the _sync_bot_capabilities(sid, session) call inside the existing if not one_turn_restore: block. The capability edit is still adopted on the very next non-once turn — bot_caps_seen is only advanced once the guarded branch actually runs.

Testing

Added 4 tests to tests/test_tui_gateway_server.py:

• test_bot_capability_sync_threads_session_overrides_into_rebuild — a pinned model/reasoning/tier survive a capability-triggered rebuild.
• test_bot_capability_sync_rebuild_without_pin_omits_override_kwargs — an unpinned bot doesn't get override kwargs manufactured out of nothing.
• test_bot_capability_sync_noop_when_fingerprint_unchanged — no rebuild when the capability fingerprint hasn't moved.
• test_prompt_submit_skips_bot_capability_rebuild_during_pending_once_restore — drives the real prompt.submit dispatch with a pending one_turn_model_restore; _make_agent must not be called during that turn.

Mutation-verified (fix reverted via git stash):

• The threading test fails — _make_agent gets called without the override kwargs.
• The once-restore test fails — _make_agent gets called at all inside the guarded window (and, revealingly, handing the turn to the freshly rebuilt agent crashes the mocked turn with AttributeError: ... no attribute 'run_conversation', since the fake rebuild returns a bare object — a concrete illustration of what an in-flight rebuild does to a running turn).

Full tests/test_tui_gateway_server.py (589 tests) and tests/tui_gateway/ + tests/tools/test_bot_mode_probe.py (499 tests) pass. ruff check clean on both changed files.

Checklist

• Tests added/updated
• Mutation-verified (fix reverted → both target tests fail)
• No behavior change for non-Bot-Chat sessions (function returns before reaching the changed code) or for a Bot Chat with no pin (override kwargs stay empty, matching current behavior)