Add fail-closed OpenRouter preflight

[dymoo]

Summary

• add a dependency-free preflight/ GitHub Action for source-free OpenRouter
  key, spend-limit, model-allowlist, ZDR, and tool-route verification
• attach the same strict data_collection: deny, zdr: true, and
  require_parameters: true policy used by CommitReview to every synthetic
  inference request
• add an optional single-provider diagnostic that reports strict-route
  ineligibility only from documented zero-attempt router metadata, never from a
  transient provider failure or as proof of one specific policy cause
• document the fail-closed ordering and release the action as v2.0.2

Why

Consumers need to prove that the current OpenRouter secret and its effective
guardrails are safe immediately before source-bearing review. A separate manual
verification workflow does not cover secret rotation or policy drift.

Validation

• npm run format
• npm run check-all (117 tests)
• parsed action.yml and preflight/action.yml with Ruby's YAML parser
• independent Standards and Spec reviews

Safety

• no repository checkout or source access
• no retry or URL/model fallback
• API key masked before network access
• 120-second deadline on every request
• exact key limit/reset and exact effective model set
• successful provider corroborated against the live ZDR endpoint registry
• diagnostic 404 accepted only with exact-model, zero-attempt,
  no-selected-endpoint routing evidence