#23694: fix: allow OAuth provider models in isolated sessions

Fixes #23677 ## Problem OAuth provider models like `openai-codex/gpt-4o` and `github-copilot/gpt-4o` were rejected with 'Unknown model' errors when explicitly selected for isolated/cron sessions or subagents, even though they worked fine in fallback chains. ## Root Cause `buildAllowedModelSet` only checked: 1. CLI providers 2. Models in the catalog 3. Providers in `models.providers` config Built-in OAuth providers are handled via auth profiles and don't appear in `models.providers`. ## Solution - Export `isOAuthProvider` from `auth-profiles/oauth.ts` - Add OAuth provider check in `buildAllowedModelSet` - Add test coverage for OAuth provider allowlisting ## Testing - ✅ All existing tests pass - ✅ Added 3 new tests covering OAuth provider model allowlisting - ✅ Verified openai-codex models work in isolated sessions