chore(release): v0.2.7 — honest pins, visible managed model, physical delete

- A pinned playground model that is unavailable now errors clearly instead of
  silently answering from the managed local model (route_source no longer lies).
- The managed CMF model is surfaced in GET /admin/api/models (marked "managed",
  shown read-only in the UI) so the real running model is visible and pinnable
  without a hand-maintained [[models]] entry; a fresh install still lists nothing.
- Deleting a model now removes its local .cmf physically (file or tensor-dir);
  deleting the managed model also stops the server and clears the [cmf] config.
  Routing is stripped of the deleted id so the config still validates.

src/pipeline.rs

@@ -267,9 +267,21 @@ impl Pipeline {
             }
         }
 
-        // Local-first safety net: if routing produced no usable candidate (e.g.
-        // an unknown pinned model while the router is off), fall back to the
-        // managed local model so a configured local backend still answers.
+        // An explicit pin must never silently answer from a different model: if
+        // the pinned id is unknown or was filtered out, fail loudly so the caller
+        // knows their choice was not honoured (instead of getting a stray reply
+        // from the managed local model via the safety net below).
+        if final_candidates.is_empty() {
+            if let RoutingDirective::Pinned { model_id } = &req.routing {
+                return Err(GatewayError::UpstreamUnavailable(format!(
+                    "pinned model '{model_id}' is not available — it is not in the pool (deleted?) or lacks a required capability such as tools"
+                )));
+            }
+        }
+
+        // Local-first safety net: for AUTO/degraded routes only, if routing
+        // produced no usable candidate, fall back to the managed local model so a
+        // configured local backend still answers.
         if final_candidates.is_empty() && live.cfg.cmf.manage_server {
             for id in live.local_candidates() {
                 if let Some(prov) = live.registry.get(&id) {