fix: add gateway-safe default model unpin

[EdgeClaws]

What changed

• makes openclaw.json mutation explicit-only via --set-primary
• adds default|reset|unpin model mode through Gateway sessions.patch {model:null}
• treats selecting the configured primary as an unpin, preserving config fallbacks
• adds --pin-exact for the distinct intentional case: hard-pin the same model as the configured primary with source=user, disabling fallbacks
• rejects conflicting --pin-exact combinations with reset mode or --set-primary
• defers active sessions instead of racing their in-flight snapshot state
• verifies no model override or liveModelSwitchPending fields remain after reset
• refuses offline reset while Gateway is running; offline repair clears stale pending state
• warns that exact source=user pins disable configured model fallback
• adds hermetic regression coverage

Intent contract

• model:null / default|reset|unpin = inherit the configured primary and its fallback policy
• selecting the configured primary without --pin-exact = the same inheritance-safe null reset
• explicit target + --pin-exact = intentional source=user hard pin, even when the target currently equals the configured primary; configured fallbacks are disabled
• --set-primary <model> = update the configured primary, then unpin sessions so they inherit it

This distinction is deliberate: equality with the current primary does not erase a caller's explicit no-fallback hard-pin intent.

Why

OpenClaw 2026.7.1 sets liveModelSwitchPending for changed non-null model patches without checking whether the session is active. An idle session can therefore carry the flag into a later user turn and surface FailoverError: Live session model switch requested. The native null-reset path explicitly deletes the flag and keeps the configured fallback chain enabled.

This PR deliberately does not synthesize or clear the pending flag through online file surgery. Gateway reset uses model:null; direct deletion is limited to offline maintenance with Gateway stopped.

Verification

• /opt/homebrew/bin/bash -n scripts/switch.sh
• /opt/homebrew/bin/bash -n scripts/test.sh
• /opt/homebrew/bin/bash scripts/test.sh → 8/8 passed
• live --dry-run --agent main against 343 sessions correctly identified and deferred the one active session; config mutation remained disabled
• three independent GPT Sol source reviews converged on the lifecycle and remediation
• Claude Opus 4.8 max review of the final follow-up diff found no blocking issues and confirmed the --pin-exact semantics, guards, tests, and documentation are reviewer-ready

Compatibility note

This intentionally changes the default config behavior: a model target no longer edits openclaw.json unless --set-primary is supplied.

The script's documented macOS execution path remains Homebrew Bash 5 (/opt/homebrew/bin/bash). The pre-existing script does not parse under macOS system Bash 3.2; this PR does not introduce or worsen that limitation.