fix(subagent): move per-role model fallback into opencodex config (#1190)

[Yuxin-Qiao]

Summary

• Fixes [Bug] Per-role model_fallback causes Codex 0.146.0 to reject custom agent TOML #1190: Codex 0.146+ strictly deserializes $CODEX_HOME/agents/*.toml and rejects model_fallback as an unknown field, which skips the entire custom-agent role definition (the role never enters the multi_agent_v1 registry).
• Per-role fallback chains now live in opencodex config as subagentModelFallbackByModel (Record<primaryModelId, string[]>), consulted after the requested primary model and before the global subagentModelFallback list — the same slot the TOML field used to occupy.
• The legacy TOML model_fallback read is kept for backwards compatibility (config-keyed chains take precedence on duplicates), but ocx doctor now scans $CODEX_HOME/agents/*.toml and warns for every role file still carrying the field, pointing at the new config home. The scan shares one TOML-aware, presence-aware parser with the reader: quoted keys are detected, text inside (multi)line strings is not, escaped delimiters stay inside strings, and malformed array values still trigger the doctor WARN while yielding no fallback entries.
• Docs updated in all locales (en, ja, ko, ru, zh-cn): fallback-chain order, the new config field, the Codex 0.146 incompatibility warning, and the JSON example.

Closes #1190

Verification

• Branch rebased onto the latest origin/dev (0 commits behind).
• bun run typecheck — clean.
• bun test tests/subagent-model-fallback.test.ts — 50 pass / 0 fail. New coverage: config-keyed resolution, cross-key dedupe with account selectors, config-over-TOML precedence, doctor scan presence including empty arrays, quoted model_fallback keys, single-line and multiline strings containing model_fallback text, escaped triple quotes inside multiline strings, and malformed arrays (missing/leading commas, trailing tokens) that stay reported by the scan while producing no fallback entries.
• bun test tests/doctor.test.ts tests/doctor-provider-apikey.test.ts tests/codex-plugins-doctor.test.ts tests/doctor-oauth.test.ts tests/config.test.ts tests/config-user-edits.test.ts — 222 pass / 0 fail.
• bun run privacy:scan — passed.
• Full bun run test (9079 tests): 12 failures in tests/management-provider-validation.test.ts, crash-guard, and a process-serialization test; re-ran the same files on a clean origin/dev worktree and got the identical failures — pre-existing on dev, unrelated to this change.
• All CodeRabbit review threads resolved (3 review rounds; last review on 6b1ce0cd completed with no new findings).

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I fixed all correct Codex and CodeRabbit findings.

• My PR is ready for review.