feat(desktop): surface cron-fleet model defaults and routing in the UI

[Cdddo]

What does this PR do?

Makes cron inference-model configuration visible and configurable in the desktop app, where it previously only lived in config.yaml — and fixes a misleading routing label.

The Models settings page gains a "Cron jobs" section exposing the fleet default (cron.model / cron.model_provider) as cascading provider/model dropdowns, a drift-guard toggle (cron.model_drift_guard), and Save/Clear actions. The drift guard's fail-closed protection against unintended spending from a changed global model is now configurable from the UI rather than only config.yaml.

Separately, the cron editor and job detail now surface the resolved model routing (Pinned / Fleet default / Global default) instead of labeling every unpinned job "Default (global model)" — which was wrong once cron.model routes an unpinned job to a non-global model (fire-time resolution is per-job pin → cron.model → global).

Related Issue

Issue describing the desktop-UI gap (Models pane missing cron config + scheduled jobs can't route to cron.model): #89513. This PR implements that surface.

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• apps/desktop/src/app/settings/model-settings.tsx — new "Cron jobs" section: drift-guard toggle (cron.model_drift_guard), cascading fleet provider/model dropdowns, Save + Clear
• apps/desktop/src/app/cron/cron-job-model.ts — jobModelRouting(), cronModelChoiceLabel(), MODEL_FLEET_VALUE routing helpers
• apps/desktop/src/app/cron/index.tsx — routing pill on job detail + truthful fleet/global options in the editor model picker
• apps/desktop/src/app/settings/model-settings.test.tsx — tests for the new section (toggle save, dropdown save, clear)
• apps/desktop/src/app/cron/cron-job-model.test.ts — tests for the routing helpers

How to Test

1. cd apps/desktop && npx vitest run src/app/settings/model-settings.test.tsx src/app/cron/cron-job-model.test.ts — 43 pass
2. Settings → Models → "Cron jobs": toggle the drift guard; set a fleet provider/model, Save; Clear removes it
3. Scheduled Jobs → open a job: routing pill shows Pinned / Fleet default / Global default; the model picker shows fleet + global as distinct options when cron.model is set

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (feat(desktop): …)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this feature
• I've run the relevant tests and they pass (43/43)
• I've added tests for my changes
• I've tested on my platform: Windows 11

Documentation & Housekeeping

• N/A — no config keys added by this PR (they already exist; this surfaces existing ones in the UI)
• N/A — no cross-platform code change (renderer-only)

Screenshots / Logs

[Enough1122]

AI code review — automated review for reference; please use your judgment.

Genuinely useful drift-guard visibility (#89513): unpinned jobs silently resolving to cron.model instead of the global model is exactly the kind of implicit routing users discover only when a bill or a model mismatch shows up, and the pinned/fleet/global badge plus always-populated model row makes fire-time resolution legible. The routing logic lives in pure exported functions (jobModelRouting, cronModelChoiceLabel) with a test matrix covering pin-with-provider, pin-without-provider, fleet-configured, fleet-empty, and global cases. Points:

1. apps/desktop/src/app/cron/index.tsx — the fleetConfig derivation (read config → shape {model, provider}) is duplicated verbatim in CronJobDetail and CronEditorDialog. Extract a useCronFleetConfig() hook so a future field rename (cron.model_provider) updates one place.
2. index.tsx:~830 — the badge labels ("Pinned" / "Fleet default" / "Global default") are hardcoded English while every surrounding string goes through t.; same for 'Global default' inside jobModelRouting. Route them through i18n like the rest of the panel, or note that this surface is intentionally English-only. (nit)
3. The editor's initial-choice mapping (pinned → its combo; unpinned+fleet → MODEL_FLEET_VALUE; else default) is tested only via the label helpers — add one assertion that saving with MODEL_FLEET_VALUE selected persists model: "" (i.e., the sentinel never leaks into the stored job), since that mapping happens outside the pure functions. (nit)
4. Tone choice (good/warn/muted per kind) is a nice at-a-glance signal; consider also showing the resolved label as the pill tooltip for narrow sidebars where the row truncates. (nit)

No blocking issues found.