fix: align every surface with current model, preparation and image rules

[SaladDay]

Behavior is taken from code and tests. Every surface that disagreed with them was fixed.

Model can be omitted

Evidence: session_model_configuration.go:51 and the provider replaces native defaults test.

• contracts/agents-api/execution-configuration.md said "no implicit deployment default". It now links to model-execution.md, the owner.
• The inline-model error now names the deployment-default exception.
• The Web How to call note (en/zh) says the model field can be removed to use the default, and that self-hosted Sessions never use it.
• The unused inlineModelRequired strings are removed.

Agents API guide, after #246/#247/#251

• Adds x_agents_core.environment: portable preparation for any placement. Self-hosted Sessions can use templates.
• Image input works on any Runtime that supports images (Codex and Claude Code). It is no longer limited to none/Docker.
• disabled and restricted networks are stored but rejected at execution, because no current Runtime enforces them. The template example no longer uses restricted.
• MCP: connection_origin table. service works on none with Codex and Claude Code; environment works in workspaces with all three harnesses.

Parsar example

The error message and README now say the example declines managed Skills on user machines. Core itself supports them.

Guard

verify-docs-facts.mjs now scans all tracked docs, contracts, OpenAPI, Web copy and Go for retired claims, and fails with a pointer to the current owner. Verified both ways: it passes on this branch and fails when the old execution-configuration.md is restored.

Validation

• check-docs, check-names, check-harness-catalog and check-example pass.
• The link check reports 0 broken links in 114 files.
• go build and go vet pass, and go test ./services/agents-api/internal/api/ passes.
• check-web: 756 unit tests and 451 component tests pass; 85 of 86 e2e tests pass. The one failure, sandbox-generation.spec.ts:50, timed out in the full run and passed 3 out of 3 reruns on its own. It is unrelated to this change.
• Not run: check-database, check-agents-api and other targets that need Docker or PostgreSQL, which are unavailable on this machine.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}