Add opt-in Fleet model-switch bridge for desktop devices

[ThinkOffApp]

Summary

• Enable only with INTENT_CHOOSER_URL; publish sanitized model_catalog, running model, ready/loading/down state and brain_of on each device beat.
• Poll owner-filed switch requests every 15 seconds, revalidate against the current local fitting catalog, handle 10-minute expiry and relay chooser errors.
• Persist and fsync claims before dispatch; reconcile uncertain POSTs and restarts without replay, with a 15-minute readiness deadline and retryable terminal reports.
• Normalize catalog/running names, recognize an already-ready model without reloading, reject ambiguous names, and rate-limit safe diagnostics.
• Disable the legacy generation probe in chooser mode to avoid competing load-on-demand activity.

Validation

• npm test in packages/user-intent-kit: 173 passed, 0 failed/skipped.
• Fake chooser and intent HTTP services cover dispatch/readiness, local validation, expiry, chooser 409, restart recovery, uncertain responses, report retry, corrupt state, overlapping polls, diagnostics and desktop field clearing.
• git diff --check clean.

Rollout

Not deployed. Requires the companion GroupMind switch route. One chooser-enabled device publisher per user/device; preserve its state file. This is no-replay recovery, not a distributed exactly-once guarantee. Petrus merges; ClaudeMB owns m5 rollout from a separate worktree without changing Hermes daemon.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T17:14:44.565277Z	b9344bc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b9344bc48f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clear chooser fields when disabling the bridge

When a daemon that previously published chooser data is restarted without INTENT_CHOOSER_URL, this returns no chooser fields while the desktop continues sending heartbeats. Because the device endpoint is explicitly a partial update (README.md:51), the prior model_catalog and brain_of values remain on the live device slot indefinitely even though switch polling is now off, leaving the UI advertising stale, unusable choices. The disabled path needs to overwrite the chooser-specific fields with empty values, at least during this transition.

Useful? React with 👍 / 👎.