[Improve] Re-land the router lookup gate (gate only, no model changes)

[daniel-lxs]

Re-lands the two-step lookup gate from #716 (reverted in #726) with all model-resolution changes stripped per review. types.ts and router-service.ts are zero-diff against develop — the router model remains exactly what it is today (context.routingModel → deployment R_SMALL_MODEL), for every routing call including the gate's precheck and the informed re-route.

What this PR is now

One behavior change, in mcp-gather.ts only: routing runs a tool-free precheck first, and the linked-issue fetch from #693 (up to 8s) executes only when that precheck returns needsExternalLookup=true and URL parsing finds a fetchable issue link. When context is fetched, routing runs once more with the issue as untrusted reference material (phase: 'mcp'); every degraded case — no lookup requested, no links, integration down, deadline expired — ships the precheck decision (phase: 'direct'), preserving fail-open.

Incident linkage

The 2026-07-23 routing outage was caused solely by #716's hardcoded google/gemini-3.6-flash default resolving to the unauthenticated direct-Google provider (ProviderAuthError → fallback picker on every message). The gate was never implicated — the throw happened before gate code ran. This PR contains no model ids and no model logic.

Verification

• 98 router tests green (gate flow: ask→fetch→re-route, skip-fetch, fetch-fails fail-open); pnpm knip, tsc --noEmit, format:check clean.
• Live end-to-end through the real routeTask + OpenCode provider path (scripts/verify-reland.ts): the incident's exact message ("Review the README in the Roomote repo") routes to the Roomote environment, confidence 0.99, model="roomote-small-model", phase: 'direct', zero fetches.

Related

• [Feat] Resolve bare issue references (#234, ENG-512) against configured repositories #722 (bare references, draft) rebases onto this after it lands.

🤖 Generated with Claude Code

[roomote-roomote]

2 issues outstanding. See task

• packages/cloud-agents/scripts/verify-reland.ts:33 The script always prints model: undefined, so it cannot verify or display the resolved default/override model that the PR claims to validate.
• packages/cloud-agents/src/server/router/mcp-gather.ts:102 If the informed re-route rejects after a successful issue fetch, the exception reaches routeTask and replaces the valid precheck with a fallback. Preserve the precheck response when this second inference fails to maintain the advertised fail-open behavior.

_{Reviewed 0d07fb4}