/model persists current selection to config.toml; clarify or make session-scoped

What I observed

When switching model with /model in the TUI, the selected model is written to ~/.codex/config.toml.

I had expected /model to behave as a session control (temporary switch), while config.toml is usually treated as a persistent default.

Why this is a problem

• Unexpected global side effect from a session command
• Low-risk one-off model experimentation can silently change future sessions
• Harder to reason about model behavior across sessions

Reproduction

1. Start Codex
2. Run /model and select a different model
3. Confirm ~/.codex/config.toml contains updated model

Expected behavior

• Keep /model session-scoped by default, or
• Make persistence explicit and documented

Suggested fix

• Add an explicit scope contract for /model (session vs persisted)
• If persistence is intended, make it obvious in UI/docs and provide explicit save semantics (e.g. /model --save)
• If session-scoped is intended, revert persistent write to config.toml