review: match session models on component boundaries, not substrings

reviewRunModelMatches used bidirectional substring matching on a separator-stripped model id, so a configured "gpt-4" (compacted "gpt4") matched a "gpt-4o-mini" session ("gpt4omini"), mis-attributing sessions to workers in multi-model profiles.

Normalize by collapsing non-alphanumeric runs to "-" (preserving component boundaries) instead of stripping them, then match with boundary-padded containment. Aliases/families still match the resolved session model ("sonnet" -> "claude-sonnet-4-5", "anthropic/claude-sonnet:high" -> "claude-sonnet-4-5") but "gpt-4" no longer matches "gpt-4o-mini". Adds table tests covering the regression and the legitimate matches.