Expression evaluators: remaining name-resolution follow-ups #710

Why

Follow-ups from #695 (same bare-name precedence in the restricted and trusted evaluators):

• model methods are excluded from the trusted bare-name lookup; decide whether that stays;
• class attributes named like builtins;
• models with a catch-all __getattr__.

Acceptance

Each case has a test on both evaluators and documented behavior.

Refs #692