Fall back to the harness probe when smith can't name a session

[edwin-zvs]

What

Auto-naming has two generators (spec 0151): a cheap smith --title-mode one-shot, and a hidden same-harness probe session for machines smith can't name. This fixes two ways a session ends up stuck on its hash name anyway.

1. The generator choice asked the wrong question. It branched on "is smith available at all" — a check that counts OAuth subscriptions and a reachable Ollama, since those genuinely start smith sessions. Title generation accepts neither: its ladder is direct API keys plus an explicit pin, and the OAuth providers are rejected outright. So an OAuth-only user (the common case: logged-in Codex or Claude CLI, no keys exported) spent their one naming attempt on a one-shot that could only fail, and never reached the probe fallback written for exactly that machine.

Now it asks whether title generation can resolve a model. Deliberately narrower than the session-startability check — that asymmetry is the one spec 0071 records as intentional, and this PR doesn't touch it. A pin naming an OAuth provider is also rejected up front rather than spawning a process that will bail.

2. A failed one-shot consumed the attempt permanently. The per-session latch is one-way and only a daemon restart clears it, so a network blip, a revoked key, or a model refusal left the session unnamed for the rest of the run. Failure now hands off to the probe.

The handoff needs a distinction the code didn't have: "nothing more to do" vs "I produced nothing". Only the second hands off. A session deleted or manually renamed while generation was in flight is the first — otherwise the fallback would spawn a probe to overwrite a title the user chose by hand. There's a test for that specific case.

Slightly beyond the ask

The doctor / features-status row for auto-naming also moved to the new predicate. It derives from the same check, and leaving it would have made the PR self-contradictory: doctor reporting "Session auto-naming [ok] — titles generated via smith" on precisely the machines this PR now routes to the probe. The degraded reason is reworded to say what actually happens ("sessions on model harnesses fall back to a one-shot on their own harness; smith and shell sessions keep their default names").

The suggestions row deliberately keeps the wider check — suggestions for smith/shell sessions spawn real smith sessions, which OAuth credentials drive fine. That's why this is a new input field rather than a repurposed one.

Not in scope

Teaching title-gen to use OAuth providers directly. That's a real improvement and would give these users the cheap path instead of the probe, but it changes what spec 0071's ladder admits and should be preceded by a spec amendment.

Spec

specs/0151 updated: the generator choice keys off what the generator can resolve rather than what a session could start on, and a generator that produces nothing hands off instead of ending the attempt. Spec 0071 needs no change — probe_smith is untouched, so its Non-Goals note about the asymmetry stays accurate.

Verification

cargo test -p construct-daemon --lib → 628 passed, 0 failed. Four new tests:

• title-gen availability counts only what title-mode can build (GROK_API_KEY → false despite being on the wider ladder; codex-oauth: pin → false; openai: pin → true)
• the auto-title status row reports on its own generator, not smith's
• a generator separates failure from a named session (non-zero exit, empty stdout, real title)
• a user rename mid-flight settles, and survives

Binary

This PR only touches crates/daemon (+ one spec) → relevant binary is construct.