feat(session): persist model tier overrides per session

Store per-session config in SQLite and route /model and /reset through command fast-paths so channel sessions keep independent model selection across reconnects and restarts.

src/config/schema.test.ts

@@ -150,6 +150,35 @@ describe('configSchema — skills watcher', () => {
     const result = configSchema.parse(minimalConfig);
     expect(result.skills.load.watch).toBe(false);
     expect(result.skills.load.watch_debounce_ms).toBe(250);
+    expect(result.skills.installation_execution).toBe('disabled');
+    expect(result.skills.allow_shell_runner).toBe(false);
+    expect(result.skills.shell_runner_allowlist).toEqual([]);
+    expect(result.skills.shell_runner_governance.owner).toBeUndefined();
+    expect(result.skills.shell_runner_governance.review_cadence_days).toBe(7);
+    expect(result.skills.shell_runner_governance.promotion_min_success_rate).toBe(0.9);
+  });
+
+  it('accepts explicit installation execution policy', () => {
+    const enabled = configSchema.parse({
+      ...minimalConfig,
+      skills: {
+        installation_execution: 'enabled',
+        allow_shell_runner: true,
+        shell_runner_allowlist: ['npm install*'],
+        shell_runner_governance: {
+          owner: 'skills-team',
+          review_cadence_days: 14,
+          promotion_min_success_rate: 0.95,
+        },
+      },
+    });
+
+    expect(enabled.skills.installation_execution).toBe('enabled');
+    expect(enabled.skills.allow_shell_runner).toBe(true);
+    expect(enabled.skills.shell_runner_allowlist).toEqual(['npm install*']);
+    expect(enabled.skills.shell_runner_governance.owner).toBe('skills-team');
+    expect(enabled.skills.shell_runner_governance.review_cadence_days).toBe(14);
+    expect(enabled.skills.shell_runner_governance.promotion_min_success_rate).toBe(0.95);
   });
 
   it('accepts explicit watcher settings', () => {