fix: guard validate_requested_model + expand test coverage (PR #649 follow-up)

- Wrap validate_requested_model in try/except so /model doesn't crash
  if validation itself fails (falls back to old accept+save behavior)
- Remove unnecessary sys.path.insert from both test files
- Expand test_model_validation.py: 4 → 23 tests covering normalize_provider,
  provider_model_ids, empty/whitespace/spaces rejection, OpenRouter format
  validation, custom endpoints, nous provider, provider aliases, unknown
  providers, fuzzy suggestions
- Expand test_cli_model_command.py: 2 → 5 tests adding known-model save,
  validation crash fallback, and /model with no argument

tests/test_cli_model_command.py

@@ -1,11 +1,7 @@
-"""Regression tests for the `/model` slash command."""
+"""Regression tests for the `/model` slash command in the interactive CLI."""
 
-import os
-import sys
 from unittest.mock import patch
 
-sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
-
 from cli import HermesCLI
 
 
@@ -58,3 +54,44 @@ class TestModelCommand:
         assert cli_obj.model == "anthropic/claude-sonnet-next"
         assert cli_obj.agent is None
         save_mock.assert_not_called()
+
+    def test_known_model_is_saved_to_config(self, capsys):
+        cli_obj = self._make_cli()
+
+        with patch("hermes_cli.auth.resolve_provider", return_value="openrouter"), \
+             patch("hermes_cli.models.validate_requested_model", return_value={
+                 "accepted": True,
+                 "persist": True,
+                 "recognized": True,
+                 "message": None,
+             }), \
+             patch("cli.save_config_value", return_value=True) as save_mock:
+            cli_obj.process_command("/model anthropic/claude-sonnet-4.5")
+
+        output = capsys.readouterr().out
+        assert "saved to config" in output
+        assert cli_obj.model == "anthropic/claude-sonnet-4.5"
+        assert cli_obj.agent is None
+        save_mock.assert_called_once_with("model.default", "anthropic/claude-sonnet-4.5")
+
+    def test_validation_crash_falls_back_to_save(self, capsys):
+        """If validate_requested_model throws, /model should still work (old behavior)."""
+        cli_obj = self._make_cli()
+
+        with patch("hermes_cli.auth.resolve_provider", return_value="openrouter"), \
+             patch("hermes_cli.models.validate_requested_model", side_effect=RuntimeError("boom")), \
+             patch("cli.save_config_value", return_value=True) as save_mock:
+            cli_obj.process_command("/model anthropic/claude-sonnet-4.5")
+
+        output = capsys.readouterr().out
+        assert "saved to config" in output
+        assert cli_obj.model == "anthropic/claude-sonnet-4.5"
+        save_mock.assert_called_once()
+
+    def test_show_model_when_no_argument(self, capsys):
+        cli_obj = self._make_cli()
+        cli_obj.process_command("/model")
+
+        output = capsys.readouterr().out
+        assert "anthropic/claude-opus-4.6" in output
+        assert "Usage" in output