fix(auxiliary): preserve auto fallback model after auth failure

[aunitt]

Summary

resolve_provider_client("auto") already lets _resolve_auto() select a fallback-chain model when the selected main provider is unavailable. However, the public wrapper then filled a missing model argument from _read_main_model() before returning the auto resolution result.

That meant a Codex-auth failure path could correctly resolve OpenRouter/Gemini Flash internally, but still hand back the stale main model (gpt-5.5) to the caller.

This keeps the existing provider-specific defaulting behaviour, but skips that prefill for provider == "auto" so _resolve_auto() can preserve the model it selected.

Why

Follow-up to #36759 / #50954. The dangerous #36759 leak path is mostly fixed by the fallback-policy changes, but this narrower wrapper regression still reproduced on current origin/main: resolve_provider_client("auto", main_runtime={...openai-codex/gpt-5.5...}) returned gpt-5.5 after the OpenRouter fallback selected google/gemini-3-flash-preview.

Tests

venv/bin/python -m pytest -q -o 'addopts=' tests/agent/test_auxiliary_main_first.py::TestResolveAutoMainFirst::test_public_auto_fallback_uses_chain_model_not_main_model
# 1 passed

scripts/run_tests.sh tests/agent/test_auxiliary_main_first.py
# 19 passed

venv/bin/python scripts/check-windows-footguns.py --diff origin/main...HEAD
# No Windows footguns found