fix(model-router): close the accepted residuals of waves 1-4

Kill switch fails closed: a present-but-unreadable override at first load
or a non-boolean enabled turns the router off (logged); /route reload says
when the previous config was kept. Prompt rules with nested quantifiers
are dropped; a config path that is not a regular file reads as failed;
caught errors log kind + code only (errWord); rejected keys are masked in
logs (keyWord), alias keys match KEY_NAME, prototype names are never keys;
offers capped at 256; a models alias without a fallback list is ranked at
the end of the default chain; canonical matches a table id at a '-'
boundary only; logCall/noteMain cannot unroute a step; route-tool failure
text no longer claims nothing was routed.

Repo side: mods suite probes the 'claude plugin test' usage line, doctor
bounds plugin list to 60 s, update-all skips @skills-dir mods.
Kit 431/431, full make test green.

lib/tests/mods.test.sh

@@ -37,10 +37,14 @@ manifest_name() {
 # cli_unavailable: prints the reason and returns 0 when the capability is missing.
 cli_unavailable() {
   command -v claude >/dev/null 2>&1 || { echo "claude not found"; return 0; }
-  local rc=0
-  bounded claude plugin test --help >/dev/null || rc=$?
+  local rc=0 out
+  out=$(bounded claude plugin test --help) || rc=$?
   [ "$rc" -eq 124 ] && { echo "probe timed out after ${CLI_TIMEOUT}s"; return 0; }
-  [ "$rc" -ne 0 ] && { echo "no 'claude plugin test' command"; return 0; }
+  # An unknown subcommand prints the generic `claude plugin` usage with rc 0:
+  # only the command's own usage line proves it exists.
+  if [ "$rc" -ne 0 ] || ! printf '%s' "$out" | grep -q 'claude plugin test'; then
+    echo "no 'claude plugin test' command"; return 0
+  fi
   return 1
 }