fix(state): route the remaining model_config marker reads through _sql_json_extract

Sibling widening of the #101726 salvage: FTS_TRIGRAM_SESSION_SQL (trigram view/triggers/backfill),
the v16 delegate-tagging data migration and reopen_session's legacy reset-child stamp still called
json_extract() on the raw model_config cell, so one malformed JSON row could still abort FTS
maintenance, a schema migration or /resume of a reset child. Zero raw model_config json_extract
reads remain in hermes_state_*.py.

hermes_state_common.py

@@ -763,7 +763,7 @@ FTS_TRIGRAM_EXCLUDED_SOURCES = ("cron", "subagent")
 FTS_TRIGRAM_SESSION_SQL = (
     "source NOT IN ("
     + ", ".join(f"'{src}'" for src in FTS_TRIGRAM_EXCLUDED_SOURCES)
-    + ") AND json_extract(COALESCE(model_config, '{}'), '$._delegate_from') IS NULL"
+    + f") AND {_sql_json_extract('model_config', '$._delegate_from')} IS NULL"
 )