refactor: improve agent file model validation and settings source deduplication

- Enhanced model parsing in agent discovery to validate against allowed values and log warnings for invalid models.
- Refactored settingSources construction in AgentService to utilize Set for automatic deduplication, simplifying the merging of user and project settings with skills sources.
- Updated tests to reflect changes in allowedTools for improved functionality.

These changes enhance the robustness of agent configuration and streamline settings management.

apps/server/src/lib/agent-discovery.ts

@@ -68,11 +68,20 @@ async function parseAgentFile(
           .filter((t) => t && t !== '')
       : undefined;
 
-    // Parse model (optional)
+    // Parse model (optional) - validate against allowed values
     const modelMatch = frontmatter.match(/model:\s*(\w+)/);
-    const model = modelMatch
-      ? (modelMatch[1].trim() as 'sonnet' | 'opus' | 'haiku' | 'inherit')
-      : undefined;
+    const modelValue = modelMatch?.[1]?.trim();
+    const validModels = ['sonnet', 'opus', 'haiku', 'inherit'] as const;
+    const model =
+      modelValue && validModels.includes(modelValue as (typeof validModels)[number])
+        ? (modelValue as 'sonnet' | 'opus' | 'haiku' | 'inherit')
+        : undefined;
+
+    if (modelValue && !model) {
+      logger.warn(
+        `Invalid model "${modelValue}" in agent file: ${filePath}. Expected one of: ${validModels.join(', ')}`
+      );
+    }
 
     return {
       description,