fix: complete demo, OpenRouter and TypeSafe provider routing

[howdeploy]

Summary

--provider typesafe currently returns unsupported provider: typesafe despite being advertised by the CLI configuration and MCP schema. This change completes the three existing native routing providers (demo, openrouter, and direct typesafe) through the CLI and stdio MCP.

• Share provider resolution with supervision, wire TypeSafe's official /v1/systemone endpoint into routing, and return the normal fallback envelope for unsupported providers.
• Apply configured API-key, endpoint, and model environment names consistently, including MCP supervision/browser decisions. Hermes and OMP now honor project configuration instead of forcing demo; Hermes allows the provider HTTP timeout to finish.
• Send OpenRouter's optional app-title header and identify its configured model in receipts.
• Add offline regression coverage and a provider guide linked from all three READMEs. Provider selection remains request → CLI flag → environment → project configuration → demo.

HTTP contracts were checked against the official TypeSafe reference and OpenRouter Decisions reference.

Checklist

• This change preserves host ownership of execution, permissions, approvals, retries, and recovery.
• No secrets, credentials, machine-specific paths, or local state are committed.
• Schema v1 and adapter compatibility are preserved or migration notes are included.
• Offline tests or fixtures cover the changed behavior.
• npm test
• npm run smoke
• npm run fail-open-smoke
• npm run clean-install-smoke
• npm pack --dry-run

Verification output

Local Node.js 26.2.0:

• npm test: 92 passed, 0 failed, 0 skipped (baseline: 26 passed).
• Smoke, fail-open smoke, clean-install smoke, MCP receipt smoke, supervision E2E and feature-flag smoke: passed.
• npm pack --dry-run --json: passed; provider resolver, documentation and regression tests included.
• git diff --check and the repository's credential-pattern check: passed.

New checks cover request/flag/environment/config precedence for all three providers; both remote HTTP payloads; missing keys, 401/422/429/529, malformed responses, invalid selections, low confidence and actual HTTP timeouts; custom environment names; and Hermes/OMP adapter transport. HTTP tests use fixture credentials and a loopback server or injected responses. Browser checks exercise structured decisions only.

No live provider inference, real browser/UI, or interactive agent model was run. Local sandbox restrictions affected npm subprocesses/cache; the required checks passed when rerun with the necessary local permissions.