review: match explicit-model inspectors before default ones; clarify timedOut read safety

Two review notes:

• Session attribution: a default-model inspector has an empty model, which reviewRunModelMatches treats as matching any recorded model (this is necessary — the session records the resolved default the inspector never named, so rejecting empty-want would stop default inspectors from ever matching). To avoid a default inspector grabbing an explicit-model inspector's session, buildLocalReviewManifestFromSummary now matches in two passes: explicit-model inspectors claim their sessions first, then default inspectors take the rest. Sources still emit in original run order. Adds a regression test (default-first + more-recent explicit session) that fails under the old single-pass logic.

• timedOut read: documented at the final-accounting loop why reading the per-agent fields is race-free (the dispatch loop returns only after close(fanIn), which the close goroutine does after wg.Wait(), i.e. after every goroutine's deferred wg.Done() that follows the field writes). No behavior change; 'go test -race' is clean.