Resolve the Auto classifier spec and any reason it was ignored.
Reads the models.auto_classifier option from managed policy, then env,
then config.toml. None means the classifier inherits the main agent
model, which is the historical behavior and the default.
A configured-but-unusable value (blank, or a non-string such as
auto_classifier = 3, which coercion drops to the default) silently
reverts authorization review to the main agent model — the agent grading its
own actions. The caller gets a description so it can say so on a surface the
user actually reads; a log line alone is not that surface.
A present-but-blank env var is an explicit "inherit" and outranks
config.toml, so it is detected before resolution rather than being skipped
as unset the way the resolver treats every other option's blank env
value. A managed value outranks that veto, so it is resolved first; a blank
managed value also forces inherit, credited to managed policy. dcode config shares this order via resolve_auto_classifier_model_with_source,
so the two surfaces cannot disagree about which model grades gated actions.
