feat(routing): propensity logging, learning loop, fingerprint sessions, hardening

[vishalveerareddy123]

Completes the routing-hardening plan (WS4, WS5, WS1.5) and fixes eight bugs found in live Claude Code sessions. Full incident-by-incident ledger in PLAN-routing-hardening.md.

WS4 — Propensity + candidates logging

• bandit.pick() returns propensity (exploit: 1−ε+ε/K, explore: ε/K); every decision path stamps propensity + candidates into telemetry, enabling off-policy evaluation from logs alone.

WS5 — Close the learning loop

• src/routing/feedback.js (new): first real caller of bandit.update(); adds conclusive outcomes (quality ≥70 / ≤40) to the kNN index using the embedding already paid for at decision time. Runs on setImmediate, never throws into the response path.
• Reward-pipeline state persists across restarts; kNN MIN_INDEX_SIZE 1000→100 with size/1000 confidence damping; in-process auto-calibration re-fits tier thresholds from telemetry every 24h and hot-reloads.

WS1.5 — Sessions that actually work for Claude Code

• Claude Code sends no session id → every request got a fresh UUID (278 distinct "sessions" per 286 requests measured live), so sticky-session pinning was dead. Session ids are now derived from sha256(first user message + system head + UA).
• Upward score-drift escape: a "Hi"-opened session pinned SIMPLE re-decides when the real task arrives; force-cloud phrases escape pins regardless of score.

Hardening (all from live incidents, each with a regression test)

• Risk classifier no longer scans harness-injected <system-reminder> text ("23+45" was risk-escalated on injected "credential/security" strings).
• Risk-forced decisions are never pinned (kills the pin-poisoning ratchet); suggestion-mode/side requests route static-SIMPLE without touching pins — gated on a detected client profile so generic API clients still get full routing.
• Tool-history check restricted to true mid-exchange frames: one tool call no longer welds a session to its pin (which silently disabled risk/context/vision guards for the rest of the session).
• Force-cloud and autonomous-agentic paths honor tier config instead of the credential-priority list (dummy databricks creds caused a self-proxy loop).
• Badge stripping no longer drops merged badge+answer blocks or produces empty content Anthropic rejects (interrupted-response echo loop).
• lynkr wrap session stats read the real snake_case metric fields over HTTP (previously showed "No requests tracked" on every exit since shipping).
• Test suite no longer clobbers the production kNN index.

Tooling

• benchmark-tier-routing.js measurement layer made honest: served model from response body (not routing headers), real pricing for local models, cache hits billed as zero, expected-tier PASS/FAIL checks, unreachable competitors reported as SKIPPED.
• Semantic cache hits are now marked in the response body (lynkr_semantic_cache).

Tests

1041/1044 passing — 3 pre-existing test/web-tools.test.js undici mock failures, unchanged from before this branch. ~80 new tests across 8 new test files.