fix(code-review): pin a same-vendor small model for BYOK reviews

[maphew]

Refs #4268.

Problem

A user set a BYOK model for Code Reviewer. The review itself used that model.
But Kilo credits still went down. The Kilo CLI used a separate small model for
title and auxiliary calls. The CLI fell through to kilo-auto/small. That
resolves to google/gemma-4-26b-a4b-it. The Gemma call goes through Kilo, not
the user provider.

Change

The web dispatcher now picks a cheaper model from the same vendor as the
effective review model. It uses the OpenRouter catalog and prompt prices.

• A managed vendor uses the cheapest strictly-cheaper sibling.
• A direct-BYOK vendor uses the primary BYOK model. The primary is used when
  the catalog has no cheaper BYOK sibling. This keeps the call on the user key.
• A managed vendor with no cheaper sibling leaves small_model unset. The CLI
  keeps its current default in that case.

The value travels as smallModel from apps/web to the sandbox session
config. It is stored in the v2 session metadata. It is part of the create
intent fingerprint. The sandbox KILO_CONFIG_CONTENT gets small_model and
agent.title.model. This applies to code-review sessions only. Bitbucket
sessions do not get agent.title.

Relation to other work

• Closes no other item. Refs nitpick: BYOK Code Reviewer still uses hardcoded Gemma 4 (Kilo credits) alongside the configured BYOK model — please use the BYOK model for everything #4268 only.
• The design follows the maintainer review on PR fix(code-review): use configured model for title/aux calls (BYOK) #4725. That PR was closed for
  inactivity. This PR takes over that design.
• PR fix(gastown): use BYOK model for review classification #5774 changed gastown's areThreadsBlocking() to use a BYOK model. That
  path uses Cloudflare Workers AI, not the Kilo gateway. It does not draw Kilo
  credits. This PR does not change gastown. The hardcoded Gemma id in gastown
  stays as a separate, smaller follow-up.
• No open PR conflicts with this change.

Adversarial review

An independent review agent examined the diff against main. It found one
critical defect in the first revision. The Durable Object rebuilt
metadata.agent from a fixed field list. It dropped smallModel, so the fix
was inert. The fix now writes smallModel in registerSession and in the
admitted-plan agent. A new Durable Object integration test asserts the
persisted value. A second review pass confirmed that all findings are closed.

Verification

Passed:

• pnpm run typecheck in apps/web, services/cloud-agent-next,
  services/code-review-infra, and packages/worker-utils.
• oxlint and oxfmt --list-different on all changed files.
• vitest run in services/cloud-agent-next for session-service.test.ts,
  session/session-prepare.test.ts, persistence/session-metadata.test.ts,
  and router/handlers/session-worktree.test.ts: 453 tests pass.
• vitest run --config vitest.workers.config.ts for
  test/integration/session/code-review-small-model.test.ts and
  test/integration/session/start-execution-v2.test.ts: 41 tests pass.

Not run locally:

• apps/web jest tests (model-selection.test.ts,
  prepare-review-payload.test.ts). The jest global setup needs a live
  PostgreSQL test database. The sandbox has no Docker and no database. CI
  covers these tests.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (19 files)

• apps/web/src/lib/cloud-agent-next/cloud-agent-client.ts
• apps/web/src/lib/code-reviews/core/model-selection.test.ts
• apps/web/src/lib/code-reviews/core/model-selection.ts
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.test.ts
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.ts
• packages/worker-utils/src/cloud-agent-next-client.ts
• services/cloud-agent-next/src/execution/types.ts
• services/cloud-agent-next/src/persistence/CloudAgentSession.ts
• services/cloud-agent-next/src/persistence/session-metadata.test.ts
• services/cloud-agent-next/src/persistence/session-metadata.ts
• services/cloud-agent-next/src/router/handlers/session-prepare.ts
• services/cloud-agent-next/src/router/schemas.ts
• services/cloud-agent-next/src/session-service.test.ts
• services/cloud-agent-next/src/session-service.ts
• services/cloud-agent-next/src/session/session-prepare.test.ts
• services/cloud-agent-next/src/session/session-registration.ts
• services/cloud-agent-next/test/helpers/session-setup.ts
• services/cloud-agent-next/test/integration/session/code-review-small-model.test.ts
• services/code-review-infra/src/types.ts

---

_{Reviewed by grok-4.6 · Input: 123K · Output: 14K · Cached: 573.2K}

_{Review guidance: REVIEW.md from base branch main}