Default thinking level for new sessions, and move the rigs out of AGENTS.md

`Config::default_effort` is what a session starts at when nothing chose one,
applied in `spawn_session` rather than filled in by the spawn screen so it
holds for an import and a bare API call too. It is set by the spawn screen's
own picker, whose label says so: one control, where new sessions are made,
rather than a settings page for a single value. Not on a provider, because
providers are discovered and the next rediscovery would erase it; not on the
phone, because a second device would then spawn at a level nobody there
chose. `GET`/`POST /defaults` carry it as a struct, so the permission mode --
still hardcoded to `auto` on the spawn screen -- can move there later without
a second route.

Only drivers that read a level are given one: an echo session was storing a
`--effort` it never passes to anything, which is a config file answering a
question about itself wrongly.

Separately, `AGENTS.md` is 35 KB sent with every request in this repo, and 12
KB of it was rigs and reference measurements that only matter once you are
running one. Those are the `ai-app-rigs` skill now -- the same text, still the
only copy, read when the work touches it. 35,198 -> 20,813 chars.

Verified on the emulator against the sandbox: the spawn screen pre-fills from
the server, picking `low` spawned a session at `low` and left `/defaults` set
to it, and an echo session spawned afterwards took no level at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -167,6 +167,17 @@ the mode, which do take effect mid-turn. `None` is a level in its own right --
 the CLI's own default -- so the picker can return to it; a level this app named
 as the default instead would be this app choosing one.
 
+**What a new session starts at is `Config::default_effort`**, applied in
+`spawn_session` rather than filled in by the spawn screen, so it holds for an
+import and a bare API call as well. It is set by the spawn screen's own
+picker, whose label says so: one control, where new sessions are made, rather
+than a settings page for a single value. It is not on a provider, because
+providers are discovered and the next rediscovery would erase it, and not on
+the phone, because a second device would then spawn at a level nobody there
+chose. `GET`/`POST /defaults` carry it, as a struct rather than a bare value
+so the permission mode -- still hardcoded to `auto` on the spawn screen -- can
+move there without a second route.
+
 **`--resume` only ever runs when nothing else has that session open.** That
 is the rule behind the import refusal, the single `ClaudeDriver::launch`
 entry point, and the `Exited` correction below; two CLIs on one session file