core/cli: soft-fail GET /models cancel/timeout on provider switch

Map CancelledError and TimeoutError from models() to RuntimeError so
merged_model_choices falls back to config/cache. Stub remote fetch in
/provider unit tests so they never hit the network.

src/plyngent/cli/models_source.py

@@ -76,11 +76,19 @@ async def fetch_remote_model_ids(
         raise TypeError(msg)
     result = method()
     if inspect.isawaitable(result):
-        if timeout_seconds > 0:
-            async with asyncio.timeout(timeout_seconds):
+        try:
+            if timeout_seconds > 0:
+                async with asyncio.timeout(timeout_seconds):
+                    result = await result
+            else:
                 result = await result
-        else:
-            result = await result
+        except TimeoutError as exc:
+            msg = f"models() timed out after {timeout_seconds}s"
+            raise RuntimeError(msg) from exc
+        except asyncio.CancelledError as exc:
+            # SSL/HTTP stacks may surface cancel instead of TimeoutError; treat as soft fail.
+            msg = "models() was cancelled or timed out"
+            raise RuntimeError(msg) from exc
     if not isinstance(result, list):
         msg = f"models() returned unexpected type {type(result)!r}"
         raise TypeError(msg)

src/plyngent/cli/state.py

@@ -305,7 +305,11 @@ class ReplState:
         return list(ids)
 
     async def merged_model_choices(self, *, refresh: bool = False) -> list[str]:
-        """Config plus remote catalog; remote fetch best-effort when refresh/missing."""
+        """Config plus remote catalog; remote fetch best-effort when refresh/missing.
+
+        Network / timeout / cancel failures fall back to cache or config-only ids
+        so ``/provider`` switches never hang or fail solely on GET /models.
+        """
         remote: list[str] | None
         try:
             remote = await self.ensure_remote_models(refresh=refresh)