fix(dispatch): fail explicitly when no enabled model qualifies

`pickModelForAgent` used to fall back to the CEO's pair when the
auto-strategy scoring returned no winner, and then silently route
the run on that pair. Three distinct problems rendered invisible by
that fallback: a missing capability row for a deployed model, a
mis-inferred task profile, a misconfigured model pool. Cost
attribution became meaningless — the agent ran on the CEO's model,
not its own tier — and operators had no signal to fix the root
cause.

The picker now returns a `ModelPickResult` tagged union. Success
yields the dispatch-ready assignment; failure yields a
`NO_QUALIFYING_CANDIDATE` reason with a human-readable message
naming the agent, the required domain, and the required tier.

Heartbeat maps the failure to a new `model_pick_failed` skip
reason, logs an activity row so it shows up in the company audit
trail, and defers. Task-runner returns `fail("MODEL_PICK_FAILED",
...)` so the UI surfaces the message directly. `getCeoAssignment`
drops out of `PickModelDeps` entirely — no caller needs a silent
CEO path any more, so the dep surface shrinks and the tests do
too. The test suite gains a regression assertion for the explicit
failure case.

src/main/orchestration/heartbeat.ts

@@ -19,6 +19,7 @@ export type HeartbeatSkipReason =
   | "budget_blocked"
   | "connector_not_ready"
   | "connector_model_not_allowed"
+  | "model_pick_failed"
   | "max_concurrent_runs"
   | "cooldown"
   | "wake_on_demand_disabled"
@@ -71,18 +72,25 @@ export function createHeartbeat(
       logger.warn(`[heartbeat] Refusing cross-company run for agent ${agentId}: ${agent.companyId} !== ${companyId}`);
       return SKIPPED("cross_company");
     }
-    const assignment = pickModelForAgent(agent, {
+    const pick = pickModelForAgent(agent, {
       getConnector: (id) => db.getConnector(id),
       getDisabledModels: (id) => db.getDisabledModels(agent.companyId, id),
-      getCeoAssignment: (cid) => {
-        const ceo = db.getCeoForCompany(cid);
-        if (!ceo) return null;
-        const full = db.getAgent(ceo.id);
-        return { connectorId: full.connectorId, modelId: full.model ?? null };
-      },
       listModelCapabilities: () => db.modelCapabilities.listModelCapabilities(),
       readConnectors: () => db.connectorsCrud.readConnectors(),
     });
+    if (!pick.ok) {
+      logger.warn(`[heartbeat] Model pick failed for agent ${agent.name}: ${pick.message}`);
+      db.addActivity({
+        companyId,
+        actor: "system",
+        action: "heartbeat.model_pick_failed",
+        entityType: "agent",
+        entityId: agent.id,
+        detail: pick.message,
+      });
+      return SKIPPED("model_pick_failed");
+    }
+    const assignment = pick.assignment;
     const connector = db.getConnector(assignment.connectorId);
     const effectiveAgentForEligibility: AgentRecord = { ...agent, model: assignment.modelId };
     const eligibilityFailure = getRunEligibilityFailure(effectiveAgentForEligibility, connector, null);

src/main/orchestration/task-runner.ts

@@ -47,18 +47,16 @@ export function createTaskRunner(
     if (agent.companyId !== task.companyId) {
       return fail("AGENT_COMPANY_MISMATCH", "The assigned agent does not belong to the task company.");
     }
-    const assignment = pickModelForAgent(agent, {
+    const pick = pickModelForAgent(agent, {
       getConnector: (id) => db.getConnector(id),
       getDisabledModels: (id) => db.getDisabledModels(agent.companyId, id),
-      getCeoAssignment: (cid) => {
-        const ceo = db.getCeoForCompany(cid);
-        if (!ceo) return null;
-        const full = db.getAgent(ceo.id);
-        return { connectorId: full.connectorId, modelId: full.model ?? null };
-      },
       listModelCapabilities: () => db.modelCapabilities.listModelCapabilities(),
       readConnectors: () => db.connectorsCrud.readConnectors(),
     });
+    if (!pick.ok) {
+      return fail("MODEL_PICK_FAILED", pick.message);
+    }
+    const assignment = pick.assignment;
     const connector = db.getConnector(assignment.connectorId);
     const effectiveAgentForEligibility: AgentRecord = { ...agent, model: assignment.modelId };
     const eligibilityFailure = getRunEligibilityFailure(effectiveAgentForEligibility, connector, task.projectId ?? null);