fix(tier2): override top-level model to MiniMax-M3

The clone's opencode.json inherited the main repo's top-level 'model'
field (zai/glm-5) via 'git clone'. The tier2-autonomous agent has its
own 'model: minimax-coding-plan/MiniMax-M3' override, so the default
agent path was technically correct, but any other agent spawned without
an explicit model (or if the user manually switched to build/plan)
would have used zai/glm-5 instead of MiniMax-M3.

Fix:
1. Add top-level 'model: minimax-coding-plan/MiniMax-M3' to
   conductor/tier2/opencode.json.fragment.
2. setup_tier2_clone.ps1 merge now overrides 'model' from the fragment
   (was only overriding agent, permission, default_agent).
3. Added test_config_fragment_has_top_level_model (default-on) to
   assert the fragment's model field.
4. Added test_setup_script_overrides_model (opt-in TIER2_SANDBOX_TESTS=1)
   to assert the merge code.

All 17 tests pass (14 default-on + 3 opt-in).

Verified: re-ran setup against the live clone; opencode.json's
top-level 'model' is now minimax-coding-plan/MiniMax-M3.

scripts/tier2/setup_tier2_clone.ps1

@@ -80,6 +80,7 @@ if ($PSCmdlet.ShouldProcess("Bootstrap Tier 2 clone at $Tier2ClonePath")) {
             if (-not $existing.permission) { $existing | Add-Member -MemberType NoteProperty -Name permission -Value ([PSCustomObject]@{}) }
             $existing.permission = $fragment.permission
             $existing | Add-Member -MemberType NoteProperty -Name default_agent -Value "tier2-autonomous" -Force
+            $existing | Add-Member -MemberType NoteProperty -Name model -Value $fragment.model -Force
             $existing | ConvertTo-Json -Depth 10 | Set-Content $cloneConfig
         } else {
             Copy-Item -Force "$MainRepoPath\conductor\tier2\opencode.json.fragment" $cloneConfig