* fix(models): reject --agent on aliases and scan instead of ignoring it
models aliases list/add/remove and models scan never read the parent
--agent option, so an operator scoping one of them to an agent got no
feedback that the flag did nothing, and a typo'd or nonexistent agent id
was never validated. They only read or write agents.defaults.*, so there
is no agent-scoped path for the flag to feed.
Reuse the existing set/set-image guard rather than inventing a new
mechanism: rename it to rejectAgentScopedModelCommand, give each
global-only command an accurate scope phrase, and call it before the
command runs. fallbacks/image-fallbacks are deliberately untouched;
they are tracked separately in #106346.
Fixes#126597
* fix(models): drop release-owned changelog entry
* fix(models): simplify global-only scope message
Review flagged the production LOC delta. Collapse the runtime scope map
into a type-only union and one accurate message covering both the read
(aliases list) and write commands; net production delta is now +20.
* fix(models): state the guard scope accurately for scan
Review finding: the shared message claimed every guarded command 'only
reads or writes global model config', but models scan --no-probe prints
the catalog and returns before any config update (scan.ts:283).
Say what is true of all six instead: they are global and never
agent-scoped. Docs line updated to match.
---------
Co-authored-by: sashankh <saisashankhd@microsoft.com>
sashankh
93573e8fdf