feat(voyage): W2 impl (S4) — gate resolver model, adopt native effort:, doc-truth

S4 of the 2.1.181 upgrade — implementation, not a gate. TDD: failing test
written first for the resolver gate, then the fix; suite green throughout.

- Resolver MAJOR (FIX): lib/profiles/phase-signal-resolver.mjs now imports
  BASE_ALLOWED_MODELS from profile-validator and gates `model`
  (if 'model' in entry && BASE_ALLOWED_MODELS.includes(entry.model)),
  mirroring the EFFORT_LEVELS gate one line up. Out-of-allowlist models
  (gpt-4, haiku) are dropped instead of handed to an agent spawn —
  defense-in-depth behind brief-validator's validation-time check. No
  circular import (brief-validator already imports the same symbol).
  +2 tests (drops-invalid / keeps-valid).
- Native effort: (SHIP, static additive): effort: frontmatter on 8 agents —
  retrieval (task-finder, git-historian, dependency-tracer,
  architecture-mapper) = medium; adversarial-reasoning (plan-critic,
  risk-assessor, contrarian-researcher, review-coordinator) = high. The
  other 15 stay unset -> inherit Opus-4.8 default (high). This per-spawn
  REASONING effort is a different axis from brief phase_signals.effort
  (ORCHESTRATION shape) per the S3 decision.
- Doc-truth + axis distinction: new canonical docs/profiles.md
  §Model & effort axes (opus->Opus 4.8 default-high; orchestration vs
  reasoning effort table; native-effort precedence; per-agent levels).
  Short notes in CLAUDE.md (after Agents table) and README.md (Cost
  profile), both pointing to profiles.md.
- Open (non-blocking, unchanged): only STATIC effort shipped — the
  verified-safe minimum. Profile-driven DYNAMIC effort still needs
  verification of the per-spawn effort param or env-var injection.

Matrix: new "S4 resolutions" section. Tests 582 total / 580 pass / 0 fail /
2 skip (was 578 pass; +2). claude plugin validate passes (only pre-existing
root-CLAUDE.md warning).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LqBYc8Ltrk7LipyJmGxXiB

tests/lib/phase-signal-resolver.test.mjs

@@ -48,6 +48,39 @@ test('resolvePhaseSignal — defensive: null/non-object input returns null', ()
   assert.equal(resolvePhaseSignal({ phase_signals: 'not-array' }, 'plan'), null);
 });
 
+test('resolvePhaseSignal — drops model not in BASE_ALLOWED_MODELS (defense-in-depth gate)', () => {
+  // MAJOR fix (S4): line that copies `model` must gate against the same
+  // allowlist brief-validator uses (BASE_ALLOWED_MODELS = ['sonnet','opus']),
+  // mirroring how effort is gated against EFFORT_LEVELS. A brief that slipped
+  // validation (hand-edited, validation skipped) must not hand a junk model
+  // string to a command that then spawns an agent with `model: <junk>`.
+  const fm = {
+    phase_signals: [
+      { phase: 'plan', effort: 'high', model: 'gpt-4' },        // invalid model
+      { phase: 'review', effort: 'standard', model: 'haiku' },  // not in BASE_ALLOWED_MODELS
+    ],
+  };
+  const plan = resolvePhaseSignal(fm, 'plan');
+  assert.equal(plan.effort, 'high', 'valid effort still resolves');
+  assert.equal(plan.model, undefined, 'invalid model "gpt-4" must be dropped');
+  assert.ok(!('model' in plan), 'model key absent when value not in allowlist');
+
+  const review = resolvePhaseSignal(fm, 'review');
+  assert.equal(review.model, undefined, 'haiku must be dropped (not in BASE_ALLOWED_MODELS)');
+  assert.ok(!('model' in review), 'model key absent for haiku');
+});
+
+test('resolvePhaseSignal — keeps valid models (sonnet, opus) after gating', () => {
+  const fm = {
+    phase_signals: [
+      { phase: 'research', effort: 'low', model: 'sonnet' },
+      { phase: 'execute', effort: 'high', model: 'opus' },
+    ],
+  };
+  assert.equal(resolvePhaseSignal(fm, 'research').model, 'sonnet');
+  assert.equal(resolvePhaseSignal(fm, 'execute').model, 'opus');
+});
+
 test('resolvePhaseSignalFromFile + CLI shim — writes JSON to stdout, exit 0', () => {
   const fixture = join(tmpdir(), `phase-signal-test-${process.pid}.md`);
   writeFileSync(fixture, `---