[harsha09]

Summary

• SDD picks a model from .sdd/models.yaml by the type of work. Route, classify, and check can use a local decider. Draft, design, code, and review stay on the strong model. A bot, a stage, or a role can override that pick.
• sdd role route calls a decider only when the reason is exactly No rule matched. With no models.yaml, the command still asks the human, and a role run still uses SDD_ROLE_MODEL.
• sdd models show, sdd models which, and sdd team check explain the pick and reject a literal secret in models.yaml without printing it.
• Decision calls are recorded on a decisions array and printed as a second section of sdd report. The existing token header and cost rows stay.

Fixes #62
Part of #58

This does not close #58. Issues #63, #65, and #66 are not in this change. The reading in the change pack is a proposal. The person has not accepted the spec, and this PR does not record a QA sign-off.

The verify stamp records b11dfd5, the HEAD before this commit. sdd verify ran pnpm test on that working tree and exited 0.

Test plan

• Core tests for model selection, the report section, metrics round-trip, the router, roles, and the team
• CLI tests for sdd models which, sdd team check, sdd role route, and sdd role run
• sdd verify workspace tests (pnpm test) exit 0
• Person accepts the reading and records QA