#13857: fix: warn when local agent models.json silently overrides central config

## Summary Adds detection and warnings for per-agent `models.json` files in `~/.openclaw/agents/<id>/agent/` that silently shadow the central `openclaw.json` model configuration. ## Problem `ensureOpenClawModelsJson` writes a local `models.json` to each agent dir on startup. These files accumulate stale provider/model entries that override central config. When users change models via `gateway config.patch`, the change appears to succeed but the local file wins — with no warning anywhere. This caused significant debugging time in a multi-agent setup (all agents showing wrong models after multiple config.patch calls). The only fix was manually `rm`-ing each agent's `models.json`. Related: #13854 ## Changes 1. **New utility** `src/agents/models-config-overrides.ts`: - `detectLocalModelOverrides(cfg)` — scans all configured agent dirs for `models.json` files and returns metadata (agent id, path, provider keys) 2. **Security audit** (`src/security/audit.ts`): - Adds a `warn` severity finding for each agent with a local `models.json` override - Includes remediation: remove the file or use `agents.list[].model` in central config 3. **Status --all** (`src/commands/status-all.ts` + `report-lines.ts`): - Surfaces override warnings in the Agents section - Shows affected file paths and a one-liner fix command ## Example output ``` ⚠️ Local model overrides detected (these silently shadow openclaw.json): → Agent "my-agent" has local models.json with providers: xai, local ~/.openclaw/agents/my-agent/agent/models.json Fix: Remove these files so agents inherit from openclaw.json, or use agents.list[].model in central config. Run: find ~/.openclaw/agents/ -name models.json -delete ``` Security audit: ``` WARN Agent "my-agent" has local models.json override ~/.openclaw/agents/my-agent/agent/models.json contains providers [xai, local] that silently shadow the central openclaw.json... Fix: Remove the local override: rm "~/.openclaw/agents/my-agent/agent/models.json" ``` ## Testing - Verified with multiple agents — all had stale local `models.json` files - After removing local files, agents correctly inherit central config - Warning only appears when local overrides exist; clean installs show nothing Closes #13854