ci(image): keep Claude Code 2.1.251; test(ceo-mode-routing): keep HOLD's own deferrals in scope before assessing its rigor decision

2.1.284 enables per-turn effort for claude-fable-5-1: in gate census
36626737820, 66 of 84 sessions ran longer than on 2.1.251 (+20% session time,
+32% thinking tokens) and 11 cases timed out on unchanged budgets.

HOLD SCOPE's 0G step asks its own defer/keep menu; the actor answered it
Defer and the assessment then judged that scope question as the rigor
decision. The actor now answers that menu Keep and assesses the next one.

.github/docker/Dockerfile.ci

@@ -93,13 +93,12 @@ RUN curl --retry 5 --retry-delay 5 --retry-connrefused -fsSL https://bun.sh/inst
 # skillify HOME discovery on 2.1.237, guard/freeze hooks on 2.1.162).
 # Bump deliberately, via a PR that runs the PTY gate against the new TUI.
 # test/ci-image-cli-pin.test.ts fails the free suite if this pin is removed.
-# 2.1.284 (from 2.1.251, 2026-09-29): 2.1.251 logs
-# [claude-code:unrecognized_model] for the eval model claude-fable-5-1;
-# 2.1.284 recognizes it. Local canary: the gate PTY smoke subset parsed on
-# both TUIs (7/8 pass on 2.1.284, 8/8 on 2.1.251; the one red was the model
-# still in WebSearch at 300 s), and plan-design-review-plan-mode passed at
-# 293 s on 2.1.284 where 2.1.251 timed out at 300 s.
-RUN npm i -g @anthropic-ai/claude-code@2.1.284
+# Stays on 2.1.251. 2.1.284 (tried 2026-09-29) enables per-turn effort for
+# claude-fable-5-1: in gate census run 36626737820, 66 of 84 sessions ran
+# longer than the same cases in run 36606688266 on 2.1.251 (session time
+# +20%, thinking tokens +32%), and 11 cases timed out on unchanged budgets.
+# Bumping it needs its own budget and skill-speed work.
+RUN npm i -g @anthropic-ai/claude-code@2.1.251
 
 # Playwright system deps (Chromium) — needed for browse E2E tests
 RUN npx playwright install-deps chromium