Return to parent on child auto-archive; GPT-6 low execution default

[Tryanks]

Closes #361
Closes #362
Closes #363

#361 — navigation after a viewed child is auto-archived

• The UI store decides the destination in one place (reconcile_destination) after every Index event. Only the on-screen conversation is reconciled, so background/batch archives never steal navigation.
• Viewed thread gone from the visible index → its still-visible parent is selected (parent replica/records untouched). Otherwise → the new-thread draft of the last interacted project; "last interacted" is set only by user navigation (select_session, start_draft) and persisted as Settings::last_project_id. Missing project → first listed; no projects → the add-project page.
• Runtime start_draft returns the standing draft for the same (project, cwd), so composer attachments and the draft's terminal survive. An in-flight guard prevents duplicate drafts.
• Empty-state design contract rewritten in docs/DESIGN.md; locale copy updated in both files.

#362 — GPT-6 execution default and Astra's Computer Use role

• Live Codex catalog (codex app-server model/list) exposes no plain gpt-6; the only GPT-6 ID is gpt-6-astra. The bundled execution default is therefore a separate codex / gpt-6-astra execution row whose description sets low effort as the baseline. The Astra collaboration row is unchanged; the two are distinct profiles.
• Uniqueness relaxed from "once across both lists" to "once per list"; add pickers, restore-default lookup and settings patches are role-aware (builtin_decision_definition / builtin_child_definition).
• Migration: an untouched bundled Sol row (default text, no profile, enabled, not fast, no legacy effort) becomes the GPT-6 execution row; any customized Sol row is preserved; an untouched Opus row gets the Sol-free text; an existing user gpt-6-astra execution row is never duplicated.
• Unavailable model: once a provider catalog is loaded, a configured model absent from it is rendered as unavailable in the fleet, shown in Settings, and dispatch/collaborate return an explicit error. Empty pre-discovery catalogs keep bundled fallbacks. Fast mode stays independent.
• astra.md / workflow.md define Astra's Computer Use responsibility: focused observe/inspect/read evidence for the lead's decision; act_ui/wait_for only on explicit brief within the thread's access mode; sweeps and code changes still go to dispatch. A runtime test proves read-only collaboration children receive the Computer Use registration when enabled.

#363 — independent collaboration and execution lists

Covered by the per-list uniqueness work above: each add picker excludes only its own list, the add guard and settings patches check the destination list only, load-time normalization dedupes within each list, and restore-default resolves the role-specific bundled text. The old cross-role rejection test is replaced by within-role dedupe coverage, and runtime resolution is exercised with one role disabled or on a different endpoint.

Tests

Store (real host + Index events): archive viewed child → parent; archive other thread → unchanged; batch archive without visible parent → standing draft reused with UI state; startup lands on remembered project / no projects → nothing selected. Each fails without the reconcile step.
Settings: literal older JSON for untouched/customized Sol shapes, no-duplicate Astra, per-list dedupe, legacy tier merge. Runtime: explicit gpt-6-astra at low resolves as expected, collaboration still capped to medium/high, loaded-catalog-missing-model error text, collaboration child Computer Use registration. UI: role-aware restore target.

Checks run locally (macOS)

cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, cargo test --workspace --locked — all pass. Mobile/Web targets and cargo machete left to CI.

Gaps

• No live rebuilt-app demonstration of Astra's Computer Use evidence handoff; covered at source/test level only.
• Composer editor text and the parent's rendered scroll position are not asserted in tests (they are view state a normal selection never touches).
• Pre-existing: IndexRemoveProject removes ProjectDraft(project_id) while draft destinations carry the draft session id, so deleting a project can leak one conversation_ui entry. Unchanged here; worth a follow-up issue.