The codex-cli driver echoed the requested model id; the model the CLI actually resolved (which can differ from the predefined one) was never surfaced, so metering and the dashboard showed the nominated model rather than reality.

The fix threads the real model through a dedicated channel rather than reusing `actual_provider` — that field is the billing *provider* slot (`UsageRecord.provider`), so putting a model there would corrupt provider attribution.

- New `CompletionResponse.actual_model: Option<String>` — "the model the provider actually ran, when it differs from the requested id; None means use the requested model". Added `actual_model: None` at every existing construction site across the workspace (drivers, runtime, kernel, tests).
- Threaded `actual_model` through the agent loop exactly like `actual_provider`: captured per-LLM-call into `last_actual_model`, carried via `EndTurn` into `AgentLoopResult.actual_model`, in both the streaming and non-streaming paths.
- The kernel's `UsageRecord` construction now records `actual_model` when present (the two `messaging.rs` agent-turn sites and the `tools_and_skills.rs` aux-review site), falling back to the nominated model otherwise — mirroring how `actual_provider` is already honoured next to it. Cost basis is unchanged (codex usage is 0/0, so the model-name override never alters billed cost).
- codex-cli driver: parse the model from codex `exec`'s stderr startup banner. Verified against codex's own source — `print_config_summary` writes `model: <value>` to stderr via `eprintln!`, unconditionally, in human-output mode (the driver's mode; it does not pass `--json`, and the `--json` event stream carries no model field per `exec_events.rs`). The parser strips ANSI styling (codex bolds banner keys), is case-insensitive and position-independent, and degrades safely to the requested model id when the banner can't be parsed so the call never breaks.

Verification:
- cargo check --workspace --all-targets — clean (all construction sites updated).
- cargo clippy --workspace --all-targets — zero warnings.
- cargo test -p librefang-llm-drivers --lib — 562 pass, incl. 3 new codex banner-parser tests (plain banner, ANSI-styled banner, absent/empty → None fallback).
- cargo test -p librefang-kernel --lib — 1238 pass.
- Runtime threading: extended the existing actual_provider survival tests (non-streaming + streaming) to also assert actual_model threads from CompletionResponse to AgentLoopResult.

…nt billing path (#6134)

The non-streaming primary agent path (`execute_llm_agent`) built its `UsageRecord` with `model: model.clone()` (the manifest-nominated id) while honouring `actual_provider` right beside it. Its streaming twin in `messaging.rs` and the ephemeral `/btw` path were updated to honour `result.actual_model`, but this site — the one the streaming path's comment says it "mirrors" — was missed, so a codex-cli call that resolved its own model still recorded the requested id on the main message path.

Use `result.actual_model.clone().unwrap_or_else(|| model.clone())` to mirror the other billing sites.