feat(tray): split routing off the Inference menu, and add a fail-closed peer-only mode

[gen16k]

Motivation

rc7 review (waired-ai/waired#986, F31): the tray's "Inference" submenu mixes three kinds of item at one level — engine actions (Disable / Stop / Stop sharing), status captions (Engine / Sharing / Mesh / Model / Worker), and an "Inference worker" radio group where the abstract modes Auto / Local only / Peer preferred sit alongside concrete per-node pins. The reviewer's three points:

• abstract modes next to concrete node pins is confusing;
• if Local only exists, Peer only should exist too;
• engine settings for THIS node and "where do my requests route" are different concerns and should be separated at the top level.

The mockup and wording for this were approved by the owner before implementation, per the issue's decision block.

What changed

Menu IA — split at the top level, not one level deeper.

Inference ▸                       Inference routing ▸   ← NEW top-level parent
  Engine: ready                     Worker: auto                 (disabled)
  Model: qwen3.6-35b-a3b            Mesh: peer engine reachable  (disabled)
  ⚠ engine version …                Choose automatically         (disabled header)
  Pause local inference             ● Auto
  Stop inference engine             ○ Local only
  Install Ollama…                   ○ Peer preferred
  ⚠ Lighter model recommended       ○ Peer only                  ← NEW
  Share engine to mesh              Pin to one peer              (disabled header)
  Sharing: enabled                  ○ sv-node (qwen3.6:35b-a3b)
                                    ○ other-node (unavailable)
                                    (clear pin)

The pins deliberately do not move one submenu deeper as the issue suggested: fyne.io/systray v1.12.2's Windows backend does not render a third nesting level (the same limit that flattened these rows under "Inference" in waired#809 — see the comment in internal/gui/tray/tray.go), and systray.AddSeparator() is top-level only. Disabled header rows are the available separation, and they are the existing pattern from the Claude Code submenu (Main conversation / Subagents). Wording keeps the current vocabulary so the tray labels and waired worker set --mode= values still line up.

ShowRoutingMenu gates the new parent: true when either the worker rows or the mesh row has content, so a daemon exposing only one of the two still gets a parent worth opening, and one predating both renders no parent at all.

peer-only — the mirror image of local-only, fail-closed.

internal/router/endpoint_router.go gets a routing branch that serves from the mesh or returns ErrModelNotReady — it never consults a ready local model, and MeshSnapshotFn == nil (the overlay-side Selector) fails rather than degrading to local. Falling back is exactly what the operator excluded, and it is the silent-local-fallback shape #325 is removing from pins.

The Claude surface inherits this without new code: selectWithWorkerPref's non-destructive local retry is gated on Mode == pinned, so peer-only propagates its error. TestClaudeSelector_PeerOnlyDoesNotFallBackLocal pins that invariant rather than leaving it to be rediscovered.

Plumbed through internal/runtime/state (const + validation), cmd/waired-agent/worker_control.go, internal/management/inference_worker.go (400 on a stray pin), internal/agentconfig, cmd/waired/worker.go (--mode, help, examples) and cmd/waired/claude_route.go. No proto change — the routing mode is agent-local state, so there is no CP contract to bump.

Verification

• gofmt -l ., go vet ./..., golangci-lint run (0 issues), go test ./... -timeout 10m, go build -tags prod ./... && go vet -tags prod ./..., make verify-cross — all green.
• Guards run locally: tray-row-mutation-guard.sh, tray-dialog-seam-guard.sh, routing-sentinel-paths-guard.sh, testnet-gate-guard.sh, decision-log-guard.py.
• docs-site: npm run i18n:check (31 pairs in sync after i18n:accept) and npm run build.
• New tests: routing submenu headers / parent gating / ShowRoutingMenu for a mesh-only and a pre-feature daemon; peer-only selected-row and label; router peer-only serves remote / fails closed with an empty mesh while local is READY / fails closed with no snapshot; Claude selector records no fallback under peer-only; and the mode rows now round-trip through the existing table tests for state persistence, the worker controller, the management handler, agentconfig and the CLI.

Note on test shape: the mode rows are rendered into pre-allocated slots typed *systray.MenuItem, which the menuRow recorder cannot substitute — a live tray session would be needed to assert the rendered slots. The real risk there is a mode row past the pre-allocation being silently unclickable, so TestApplyWorkerModeSlotsMatchPreallocation pins len(WorkerModes) == workerModeSlots instead.

Refs

Fixes #327
Refs waired-ai/waired#1002 (L18)
Refs waired-ai/waired#986
Refs #325 (shared fail-closed contract), #326 (deterministic pin row order, merged separately)

• Decision: docs/decisions/20260801/1840-tray-routing-split-and-peer-only.md

[github-actions]

📘 Docs preview for this PR: https://waired-docs--pr-377-txi1imv4.web.app

Rebuilt on each push; the preview channel auto-expires in 7 days.