Add an opt-in orchestrated CoS mode with per-role provider/model and per-step reasoning effort

[atomantic]

Summary

Adds the opt-in orchestration profile from #5992: a CoS run can be split into three roles — architect (plans, writes specs, delegates), implementer (executes one spec), reviewer (checks it) — each with its own provider, model, and reasoning effort, instead of resolving one provider + one model + one effort for the whole run.

• server/lib/orchestrationProfile.js — vocabulary, normalizer, role gating, and the six-part spec contract a context-free delegated lane needs. parseReasoningDirective never rounds: an unsupported rung is an error, because substituting the nearest supported level would run a step at an effort nobody chose while still reporting success.
• selectModelForRole sits alongside selectModelForTask, which now resolves through the architect role. With no profile the selection is unchanged, and there is a test asserting that equivalence.
• resolveStepEffort resolves a delegated step's rung as spec directive → role default → run effort.
• buildOrchestrationDoctrineSection renders the architect doctrine into all three prompt paths (template, full, light). It returns '' for every direct-mode task — the default — so an install that configures no profile is untouched.
• The mode + profile persist as CoS task metadata (addTask, updateTask, and the create/update routes), with the repo's absent-vs-cleared semantics.

No migration or data.reference/ seed: both keys ride the existing free-form task-metadata blob, additively, so an older peer ignores them.

Naming decision: the issue proposed executionMode: 'direct' | 'orchestrated'. Agent metadata already carries an executionMode meaning tui / runner / runner-tui / direct — reusing the name, including the value direct, for an unrelated axis would have made both unreadable. Shipped as orchestrationMode instead.

Test plan

• cd server && npm test — full server suite green (1 unrelated load-timeout flake in routes/settings.secretsStrip.test.js, passes on its own re-run).
• New: server/lib/orchestrationProfile.test.js, server/services/promptSections/orchestrationDoctrine.test.js.
• Extended: agentModelSelection.test.js (role pin wins; unpinned role and direct-mode task are identical to selectModelForTask), agentProviderResolution.test.js (architect provider pin resolves; a direct-mode task keeps its own metadata pin), thinkingLevels.test.js (spec → role → run precedence; unsupported rung errors), cosTaskRoutes.test.js (pass-through, unknown role rejected, bad rung rejected, clear-on-update).

Remaining

Deliberate partial ship — the rest of #5992 stays open:

• Client profile picker on the CoS task form and in /ai.
• A machine-local named-profile library in Settings (per the issue's "profiles are per-install config, not a federated record"), so a profile is configured once rather than per task.
• Feeding resolveStepEffort from a returned spec at the point PortOS re-dispatches a delegated unit, once that lane exists — today the rung reaches the lane through the prompt contract, which is the only channel available while sub-agent dispatch happens inside the agent CLI.

Refs #5992

[atomantic]

Required code review was not completed before publication. This PR is intentionally left open and will not be merged until the required review completes.