[LinoyBitan1]

Let users change the default inference model in the provider profile when a model becomes unavailable, without editing installer code. NVIDIA, OpenAI, and Anthropic each supply their own default_model; users can still choose a model for a provider or sandbox.

Follow-up to #132.

What changes

• Add default_model to the governance/provider profiles and remove the hardcoded Python fallback and duplicate defaults from BOM definitions, Secret templates, and portal forms.
• Resolve models in this order: sandbox override → provider model, including its Secret override → provider-profile default. Custom endpoints require an explicit model; missing models produce a warning and skip onboarding.
• Honor NVIDIA Secret model overrides in both data-science workspaces. Keep the portal Model field optional and preserve existing explicit model choices.
• Strip default_model before importing profiles into OpenShell. Credential updates preserve Secret fields the user did not supply.
• Document model selection and credential updates. Isolate the CLI test namespace from values inherited through make.

Testing

• Installer regression tests cover all three providers, model precedence, Secret overrides, custom endpoints, and profile import stripping.
• Chart, portal, and CLI regression run: 477 passed, one skipped. Catalog freshness, shell syntax, and whitespace checks passed.
• CI on e48563b: Python 3.12, Python 3.14, and bundle drift checks passed.
• Fresh OpenShift deployment using README Option A: all 12 Argo applications Synced and Healthy.
• Live CUDA-sandbox OpenClaw inference returned OK with the shipped NVIDIA default and an alternate model selected by changing only the profile's default_model in an isolated configuration copy.
• Deployed model-resolution checks passed for NVIDIA, OpenAI, and Anthropic. OpenAI and Anthropic model-list endpoints returned HTTP 200 with the supplied credentials.
• Both APIs also authenticated from inside the notebook through the governed proxy. A direct OpenAI GPT-6 Luna inference request returned HTTP 200 and OK; the notebook picker was verified to show all three provider groups.

Remaining work

Complete notebook chat validation with OpenAI and Anthropic. The test notebook required an explicit OpenAI API-key route and OPENAI_API_KEY environment binding to make OpenAI selectable; that cluster-only configuration is not automated by this PR. Direct API inference does not yet establish successful OpenClaw chat; the notebook CLI agent-run check is limited by its gateway RPC permissions.

[LinoyBitan1]

Closing in favor of follow-up PR #139, which includes the relevant changes from this PR and follows the credential/model separation introduced in #135.

It also includes fixes found during deployment testing. NVIDIA, OpenAI Luna, and Anthropic Sonnet inference were verified on OpenShift.