feat(auxiliary): give short auxiliary calls their own lane, off the conversation's KV slot

[OmarB97]

Every auxiliary.<task>.provider ships as "auto", and _resolve_auto's first
priority is "the user's main provider + main model". On a local-only setup that
is not a preference, it is a constraint: every auxiliary call lands on the
same endpoint as the conversation itself.

On a single-slot local server (llama.cpp -np 1, vLLM with one slot) that is
actively harmful. A goal judge or approval classifier sends 2-6K tokens; the
conversation is 95K. The short call takes the slot, the long conversation's KV
cache is evicted, and the next main turn re-prefills from zero. Measured on the
affected lane: 8/8 prompt-cache misses against a 3% baseline. The request
bytes are provably stable (tests/agent/test_request_prefix_stability.py, #334),
so eviction is what is left.

The same contention shows up a second way, which is what makes this worth fixing
rather than documenting. The approval classifier is itself an aux call, so it
queues behind the very turn it is meant to gate — the session self-contends,
the classifier times out, and _smart_approve falls back to asking a human. In
an unattended delegated run there is no human, so the run stops. One cause, two
symptoms: a cold cache and a stalled agent.

What this adds

auxiliary.route — one lane that every aux task falls back to:

auxiliary.<task>.*   >   auxiliary.route.*   >   "auto" (main lane)

Shipped empty, so with no config written the behavior is byte-identical to
today. Point it at a second endpoint and the short calls go there instead.

The overlay lives at exactly one site, _resolve_task_provider_model
(agent/auxiliary_client.py), which all five aux resolution entry points funnel
through — call_llm, async_call_llm, get_text_auxiliary_client,
get_async_text_auxiliary_client, resolve_vision_provider_client. It is
deliberately not at _resolve_auto, because agent/agent_init.py builds the
main agent's client through that same function and a hook there would hijack
the main lane.

Because "auto" now means "the route", the per-task escape back to the live chat
model is the already-supported auxiliary.<task>.provider: main.

The trap this had to defeat first

An earlier attempt at this change was abandoned because it stalls unattended
turns, and the mechanism is worth stating precisely, since it is not obvious.

tools/approval.py::_smart_approve fails closed: any exception becomes
return "escalate", logged at debug. Separately, call_llm's fallback gate is

if should_fallback and (is_auto or is_capacity_error):

Setting a route makes resolved_provider concrete, so is_auto goes false. An
aux endpoint that is down raises a connection error, which counts as a
capacity error, so it falls back to the main lane and everything works. An aux
endpoint that is up but returns 401 raises an auth error, which is not in
the capacity set — so the entire fallback block is skipped, the exception reaches
_smart_approve, and every smart auto-approval silently becomes a human prompt.
In a gateway-backed unattended run that is a 60s approval timeout and then a hard
block, per flagged command. Silently, because the only trace is a debug line.

So the gate now reads (is_auto or is_capacity_error or route_derived), in both
the sync and async paths. is_auto exists to respect a user's explicit per-task
pin; a provider that arrived from the global route is a routing default, not that
pin. With this, the same 401 dud costs one attributed warning and the main lane
answers.

Four supporting guarantees, so that pointing aux at an endpoint which may be
down, unkeyed, or slow can never be worse than today:

• Quarantine. _mark_provider_unhealthy was only ever called for payment
  errors. A dead routed lane now pays its penalty once per TTL, not once per call.
• Bounded budget. auxiliary.approval.timeout is 30s with 2 transient
  retries — about 93s, which out-waits the 60s human approval timeout. Routed
  calls get their own timeout and transient_retries (default 0), floored under
  the human budget for the approval task.
• Loud. The debug swallow in _smart_approve is now a warning, and routed
  failures go through the existing AIAgent._emit_auxiliary_failure, so the
  operator sees one attributed line in chat instead of nothing.
• Preflight. The route is resolved once at agent init and warns loudly if it
  yields no client or the no-key-required placeholder.

The silent 401, root-caused

That placeholder deserves its own commit, because it is a real bug independent of
this feature. hermes_cli/runtime_provider.py's new-style providers: dict path
resolves key_env internally but does not return it — only the legacy
custom_providers: list path does. So the second-chance os.getenv(key_env)
lookup in auxiliary_client could never rescue a providers: entry, and a client
was built with the literal string "no-key-required" and the request sent anyway.
key_env is now carried out of both paths.

Deliberately out of scope

background_review and curator resolve their own model and stay main-model-first
on purpose — they replay the full transcript because it is already warm in the
main prompt cache, and agent/background_review.py already switches to a compact
digest when routed away "because a different model can't reuse the main prompt
cache anyway". Routing them would force a digest replay to save a cache they were
built to exploit. plugin_llm and trajectory_compressor pass no task and stay on
auto.

Also worth stating plainly: with fallback_policy: "any" (the default), an
unreachable aux lane silently re-routes back to the main lane. Prompt-cache
protection is best-effort by design. That fallback is load-bearing — removing it
is what converts a slow degradation into the approval trap above.

Testing

scripts/run_tests.sh across the auxiliary client, aux routing, image routing,
runtime cache key, smart approval, goals, aux config, plugin aux tasks, vision
routing and config suites: 705 tests, 0 failures (and 237 more across the
config/vision/approval-cluster set).

The existing approval and goal tests all stub at the call_llm / _smart_approve
/ judge_goal boundary, so none of them can observe a routing regression — which
is precisely why this trap survived an earlier attempt. The new
tests/agent/test_auxiliary_route.py drives the route end to end instead of at
that seam, and its headline case is the one that matters: route set, aux
endpoint returns 401, _smart_approve must not escalate — the call falls back
to the main lane and answers.

Also covered: route unset resolves byte-identically to today; a task's own
explicit provider still beats the route; provider: main still returns the live
chat model; connection errors quarantine the routed provider; the routed approval
budget is provably under approvals.timeout; a providers: entry with key_env
resolves a real key; and the goal judge still fails open on a routed lane,
with its five-consecutive-transport-failure auto-pause intact.