agents.list[].model was agent-tunable while agents.defaults.model was
refused — the same capability gated by config shape (partially reverts
the defaults-spelling removal from #90145; token/auth/exec paths stay
protected). The bare refusal string also caused agents to misread the
injection boundary as an authorization failure and argue with the owner;
it now states the contract, the remedy, and the agent-tunable paths.
Guard moved to gateway-config-guard.ts (gateway-tool.ts 652->390).
Closes#106059
6908e6a63b