docs(custom-model): make the docs match the code, and trim the changeset

More from the review of 5fc391a4, all documentation rather than behaviour.

The changeset was 1602 words of development log, written as the PR grew, with bullets
and loose paragraphs interleaved. That text becomes CHANGELOG.md and the GitHub release
body verbatim, so it is now one user-facing account of what the feature does and what
the real-server work bought, at roughly a fifth the length.

docs/api-reference.md promised a `cmd` field on running-status that the route
deliberately strips (it carries model paths and can carry --api-key).

Two places claimed the apply routes validate `modelId` against the endpoint's
discovered models. Neither does. Dropped the claim rather than adding the check:
discovery can be up to five minutes stale, so a 400 there would refuse a launch that
actually works, and a typo'd id already fails on the CLI's own first request. CLAUDE.md
now says so explicitly, since the absence is the surprising part.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/web/public/session-ui.js

@@ -920,8 +920,8 @@ Object.assign(CodemanApp.prototype, {
     // _apiJson() (used everywhere else in this file) unwraps a success body to
     // its `data`, but on failure it swallows the response entirely and returns
     // null — exactly the `error` text a caller needs to tell "the endpoint is
-    // unreachable" apart from "the CLI can't be redirected", "not one of the
-    // discovered models", or "this is a Docker/remote session". Go through the
+    // unreachable" apart from "the CLI can't be redirected" or "this is a
+    // Docker/remote session". Go through the
     // raw response here instead so a failure is diagnosable, not just present.
     let { ok, data, res } = await this._applyCustomModelToSession(sessionId, endpointId, modelId);