refactor(runtime): extract model-fallback chain into fallbackExecutor

[dgageot]

Summary

The model-fallback subsystem owned three fields and a mutex on
LocalRuntime that no other code touches:

retryOnRateLimit     bool
fallbackCooldowns    map[string]*fallbackCooldownState
fallbackCooldownsMux sync.RWMutex

…plus five methods on *LocalRuntime whose only job is to
operate on that state. The boundary was already there implicitly.
This PR makes it explicit by introducing a fallbackExecutor type
that owns the state and methods, and replacing the three runtime
fields with one (fallback *fallbackExecutor).

What changes

Before	After
LocalRuntime.retryOnRateLimit bool	fallbackExecutor.retryOnRateLimit
LocalRuntime.fallbackCooldowns map[…]	fallbackExecutor.cooldowns
LocalRuntime.fallbackCooldownsMux sync.RWMutex	fallbackExecutor.cooldownsMux
r.getCooldownState / setCooldownState / clearCooldownState	methods on *fallbackExecutor
r.tryModelWithFallback(...)	r.fallback.execute(...)
r.handleModelError(...)	e.handleModelError(...) (executor-private)

Stateless helpers (buildModelChain, logFallbackAttempt,
logRetryBackoff, getEffectiveCooldown, getEffectiveRetries)
stay free — they have no reason to move.

The two callers of getCooldownState outside fallback.go
(getEffectiveModelID and agentDetailsFromTeam, both for
cooldown-aware sidebar display) updated to r.fallback.X.

WithRetryOnRateLimit() now sets the flag on r.fallback
instead of the runtime field — a one-line change.

Why this one and not the others

I evaluated several extraction candidates honestly. The strongest
case for this one:

• Real shrinkage: LocalRuntime loses 3 fields + a mutex. No
  other candidate I considered (sub-session, stream chunker)
  shrinks the runtime struct.
• Zero speculation: the cooldown map and retry flag are
  already de-facto private to fallback logic. Making the boundary
  explicit doesn't bet on future callers — it just names what's
  already true.
• No public-API change: WithRetryOnRateLimit() is the only
  public touchpoint and its signature is unchanged.

Diff size

5 files, +81 / −50:

• pkg/runtime/fallback.go — most of the change (rewriting
  receivers, adding the executor type, the constructor, doc
  paragraph)
• pkg/runtime/runtime.go — drop 3 fields, add 1, update 2
  call sites in cooldown-aware UI code, update one Opt
• pkg/runtime/loop.go — one call site updated
• pkg/runtime/fallback_test.go — 8 lines: update direct cooldown
  test to call through rt.fallback
• pkg/runtime/runtime_test.go — 2 stale doc-comment references
  to "tryModelWithFallback" updated

Behaviour

Unchanged. Same cooldown semantics, same retry policy, same events
emitted (ModelFallback, AgentInfo), same error wrapping
(ContextOverflowError), same logging.

Validation

• mise lint — 0 issues across 807 files
• mise test — full suite passes (including the cooldown unit
  tests that now go through rt.fallback)

Honest scope assessment

This is a structural improvement: the runtime struct shrinks,
fallback state lives in one named place, and the boundary is
documented. It is not a behaviour change, a feature, or
preparation for a specific future refactor. It pays for itself
on day one because today, anyone reading LocalRuntime no longer
sees three fields whose purpose is opaque without reading
fallback.go.

A natural follow-up — moving fallbackExecutor into a sub-package
(e.g. pkg/runtime/internal/fallback) for compile-time isolation —
is intentionally not done here. It would require inverting the
events-channel dependency (since Event is currently a runtime
type), which is a much bigger refactor and explicitly out of scope.