Promote model_spec to the front of the recent-models MRU list.
Existing entries for the same spec are moved (not duplicated); the list
is capped at RECENT_MODELS_LIMIT. Best-effort: returns False on I/O
error so callers can degrade silently — recents are a nice-to-have, not
a correctness requirement.
A spec outside models.allowed also returns False. That refusal is
deliberately silent here: the MRU is a derived cache, and the visible
consequence (the spec not appearing under Recent) is already explained by
the selector's policy empty state.