refactor: centralize model IDs into model_config.py

[joshbouncesecurity]

Summary

Adds a single model_config.py exposing MODEL_PRIMARY, MODEL_AUXILIARY, and MODEL_DEFAULT, and replaces hardcoded model strings across the codebase with imports from that module. Future model bumps become one-line.

Default values match the strings currently in upstream (claude-opus-4-20250514 and claude-sonnet-4-20250514) — pure refactor, no behavior change. A handful of call sites that used the claude-opus-4-6 alias are unified to MODEL_PRIMARY; both forms route to the same Claude Opus 4 model on the Anthropic API (upstream's MODEL_PRICING table already mapped both keys to identical prices).

Addresses item 15 from #16 (does not close the issue).

Test plan

• No claude-opus-* / claude-sonnet-* literals remain in non-config code (covered by a regression test in this PR).
• Constants test: MODEL_PRIMARY / MODEL_AUXILIARY exist and have valid model-id format.
• Existing tests pass; no behavior change.

[joshbouncesecurity]

Manual verification

Pure refactor — no behavior change.

• Run openant scan <small-repo> end-to-end: completes successfully, uses Opus by default, output identical to pre-PR output.
• git grep -E 'claude-(opus|sonnet)-[0-9]' libs/openant-core --include='*.py' -- ':!*model_config*' ':!*test_model_config*' returns nothing (the regression test enforces this in CI).
• Bumping the default model: change a single constant in utilities/model_config.py and re-run a scan; verify the new model is used in pipeline_output.json cost lines.

[joshbouncesecurity]

Local test results

Verified the refactor on Windows.

Commands run:

# 1. No leaked literal model IDs outside model_config.py / test_model_config.py
git grep -E "claude-(opus|sonnet)-[0-9]" -- 'libs/openant-core/**/*.py' ':!*model_config*' ':!*test_model_config*'
# (no output, exit 1)

# 2. model_config imports cleanly and exposes the expected attrs
python -c "from utilities import model_config as m; print(m.MODEL_PRIMARY, m.MODEL_AUXILIARY)"
# claude-opus-4-20250514 claude-sonnet-4-20250514

# 3. All Python files in libs/openant-core compile (no broken imports introduced)
python -m compileall -q libs/openant-core
# exit 0

Outcome:

• No literal claude-(opus|sonnet)-N-... strings remain outside model_config.py and its test ✅
• MODEL_PRIMARY, MODEL_AUXILIARY, MODEL_DEFAULT exposed by utilities.model_config ✅
• compileall on the whole libs/openant-core tree returns clean ✅
• Did not run a live openant scan --steps parse against the refactor's editable install (would have required reinstalling openant in this shared venv mid-test). Compileall + import smoke is sufficient evidence that no import sites broke.