phase 1: add [models] tier config — additive, no callers migrate yet

Codifies the small-model-pipeline tiering (per project_small_model_pipeline_vision.md)
in lakehouse.toml [models] section. Tier names map to actual model
IDs; bumping a model means editing one line, not hunting through code.

Tier philosophy:
- local_*    : on-box Ollama. Inner-loop hot path. Repeated calls.
- cloud_*    : Ollama Cloud (Pro plan). Larger context, fail-up tier.
- frontier_* : OpenRouter / OpenCode. Rate-limited, billed per call.

weak_models is the codified "local-hot-path eligible" list — phase 2
will migrate matrix.downgrade to read it instead of hardcoding.

Defaults reflect 2026-04-29 architecture: qwen3.5:latest as local
(stronger than qwen2.5, same JSON-clean property), kimi-k2.6 as cloud
judge (kimi-k2:1t still upstream-broken), opus-4-7 + kimi-k2-0905 as
frontier review/arch via OpenRouter, opencode/claude-opus-4-7 as
frontier_free leveraging the OpenCode subscription.

3 new tests in internal/shared/config_test.go:
- TestDefaultConfig_ModelsTier — locks tier defaults
- TestModelsConfig_IsWeak     — weak-bypass list
- TestLoadConfig_ModelsTOMLRoundTrip — override semantics

just verify PASS (g2 had one flake on first run — Ollama transfer
truncation; clean on retry, unrelated to this change).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lakehouse.toml

@@ -80,3 +80,39 @@ use_path_style  = true
 
 [log]
 level = "info"
+
+# Model tier registry — names map to actual model IDs per the small-
+# model pipeline architecture (project_small_model_pipeline_vision.md).
+# Bumping a model means editing one line here, not hunting through code.
+#
+# Tier philosophy:
+#   - local_*    : on-box Ollama. Inner-loop hot path. Repeated calls.
+#   - cloud_*    : Ollama Cloud (Pro plan). Larger context, fail-up tier.
+#   - frontier_* : OpenRouter / OpenCode. Rate-limited, billed per call.
+#                  Reserved for blockers and full-scope reviews.
+#
+# weak_models is the codified "local-hot-path eligible" list that the
+# matrix.downgrade gate reads. A model in this list bypasses the
+# strong-model downgrade rule (it's already weak — no need to downgrade
+# corpora further).
+[models]
+# Tier 1 — local hot path
+local_fast    = "qwen3.5:latest"
+local_embed   = "nomic-embed-text"
+local_judge   = "qwen3.5:latest"
+local_review  = "qwen3.5:latest"
+
+# Tier 2 — Ollama Cloud (Pro). kimi-k2:1t still upstream-broken;
+# deepseek/kimi-k2.6/qwen3-coder are the working primaries.
+cloud_judge   = "kimi-k2.6:cloud"
+cloud_review  = "qwen3-coder:480b"
+cloud_strong  = "deepseek-v3.2"
+
+# Tier 3 — frontier. Use sparingly; rate-limited + per-call billing.
+frontier_review = "openrouter/anthropic/claude-opus-4-7"
+frontier_arch   = "openrouter/moonshotai/kimi-k2-0905"
+frontier_strong = "openrouter/openai/gpt-5"
+frontier_free   = "opencode/claude-opus-4-7"
+
+# Local-hot-path eligible — matrix.downgrade bypass list.
+weak_models = ["qwen3.5:latest", "qwen3:latest"]