Harden OpenRouter provider privacy policy

[dymoo]

Outcome

Attach OpenRouter provider privacy requirements inside the LLM request builder so every review request fails closed unless routing denies data collection, is ZDR, and supports the requested parameters.

Contract

• exact https://openrouter.ai/api/v1 match only
• data_collection: deny, zdr: true, and require_parameters: true on every request
• no behavior change for other OpenAI-compatible endpoints
• no model or endpoint fallback
• patch release metadata for v2.0.1

Verification

• npm run format
• npm run check-all (102 tests)
• independent standards review: no violations
• independent spec review against byline-fyi/byline#212: no findings

Supports byline-fyi/byline#212.

[dymoo]

The review check fails before any model request because pull_request_target executes the workflow from the current default branch, where the optional dogfood job has no LLM_API_KEY/URL/model configured. This PR adds the non-secret configuration gate, but that gate cannot affect its own pull_request_target run. The authoritative Node 20 and Node 24 CI jobs pass, and the full local npm run check-all suite passes (102 tests).