fix(model-router): close the accepted residuals of waves 1-4

Kill switch fails closed: a present-but-unreadable override at first load
or a non-boolean enabled turns the router off (logged); /route reload says
when the previous config was kept. Prompt rules with nested quantifiers
are dropped; a config path that is not a regular file reads as failed;
caught errors log kind + code only (errWord); rejected keys are masked in
logs (keyWord), alias keys match KEY_NAME, prototype names are never keys;
offers capped at 256; a models alias without a fallback list is ranked at
the end of the default chain; canonical matches a table id at a '-'
boundary only; logCall/noteMain cannot unroute a step; route-tool failure
text no longer claims nothing was routed.

Repo side: mods suite probes the 'claude plugin test' usage line, doctor
bounds plugin list to 60 s, update-all skips @skills-dir mods.
Kit 431/431, full make test green.

doctor.sh

@@ -179,8 +179,12 @@ except Exception:
 
 _mods_list=""
 if command -v claude &>/dev/null; then
-  if ! _mods_list=$(claude plugin list --json 2>/dev/null); then
-    warn "mods: claude plugin list failed — load state not checked"
+  # Bounded: a hung CLI must not stall doctor (coreutils timeout; without
+  # it the call runs unbounded, as before).
+  _mods_timeout=""
+  command -v timeout >/dev/null 2>&1 && _mods_timeout="timeout 60"
+  if ! _mods_list=$($_mods_timeout claude plugin list --json 2>/dev/null); then
+    warn "mods: claude plugin list failed or timed out — load state not checked"
     _mods_list=""
   fi
 fi
@@ -209,7 +213,7 @@ for _mod_manifest in "$REPO"/mods/*/.claude-plugin/plugin.json; do
   esac
 done
 [ "$_mods_seen" -gt 0 ] || info "no mods"
-unset _mods_list _mods_seen _mod_manifest _mod _mod_link
+unset _mods_list _mods_seen _mod_manifest _mod _mod_link _mods_timeout
 
 echo ""