R7: pluggable SelectorPolicy seam + local-OSS (Ollama) confirmatory agent arm

Adds the RQ3 agent-selector backend as a reproducible, offline measurement
decision — not relay/data-plane traffic. Containment is untouched: the model
query is a local call to localhost:11434.

- selector.py: SelectorPolicy ABC seam; static/random/agent(heuristic) built-ins;
  make_policy() resolves (strategy, agent_backend); run_selection writes a
  write-once selector.json provenance sidecar.
- agent_selector.py: OllamaAgentPolicy — reproducible confirmatory arm
  (temp=0 + per-run seed, decisions cached keyed by (seed, state-hash),
  deterministic heuristic fallback on any model/parse failure, model weights
  digest pinned for the manifest). ClaudeExploratoryPolicy — EXPLORATORY-only
  stub: makes no paid call, refuses to serve as a confirmatory backend.
- provenance.py: additive selector_backend field so an agent-selected run pins
  the exact model id + weights digest.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cmd_chat/sor/provenance.py

@@ -141,6 +141,9 @@ class RunManifest:
     worktree_root: Path = field(default_factory=lambda: Path.cwd())
     start_utc: Optional[str] = None
     stop_utc: Optional[str] = None
+    # R7 agent arm: model id + weights digest of the selector backend (e.g. the
+    # local Ollama model), so an agent-selected run pins the exact model it used.
+    selector_backend: Optional[Dict[str, Any]] = None
 
     def to_dict(self) -> Dict[str, Any]:
         if self.engine_kind not in ISOLATED_ENGINES:
@@ -161,6 +164,7 @@ class RunManifest:
                 "kind": self.engine_kind,
                 "image_digest": self.engine_image_digest,
             },
+            "selector_backend": self.selector_backend,
             "git": capture_git(self.worktree_root),
             "deps": capture_deps(self.worktree_root),
             "timestamps": {