fix: prefer exact model registry IDs over aliases

[kbentonferguson]

Problem

When two enabled registry entries expose the same adapter model name through different provider namespaces, resolving a fully qualified registry ID also collects normalized alias matches from the sibling entry. The exact pin is then rejected as ambiguous, so callers cannot use the registry ID itself to disambiguate API and subscription-backed routes.

Summary

• resolve an exact enabled registry ID before adapter-model and normalized-token aliases
• preserve fail-closed ambiguity for bare model names
• support duplicate provider namespaces that expose the same underlying model name

Verification

• RED reproduced ambiguity for exact agentic/gpt-5.6-sol with an enabled Codex alias
• CursorModelPinTests — 10 passed
• routing/model-guard selection — 27 passed
• py_compile and git diff --check passed
• independent Sol review passed with no findings or risks