LLM candidate re-ranker — Act 1 SCOPE filter (T446)

An optional one-call sonnet-tier filter that runs during LocalBrain.boot() (Act 1 SCOPE). After the task-text extractor and git co-change ranker assemble a combined ~15-file candidate set, the re-ranker asks a cheap LLM to return the top-N most task-relevant files, dropping false positives before the worker reads anything.

Off by default. Enable with CYBERINE_CANDIDATE_RERANK=true. Requires OPENROUTER_API_KEY or DEEPSEEK_API_KEY. Any LLM failure, timeout, or missing key degrades silently to the un-reranked candidate list — the worker always gets a useful context pack.

Gate conditions (all must hold to make the LLM call):

1. CYBERINE_CANDIDATE_RERANK=true
2. A provider key is configured (OPENROUTER_API_KEY or DEEPSEEK_API_KEY)
3. Combined candidate list has more than 3 entries

When any gate condition is not met, candidates pass through unchanged (zero latency, zero cost).

# Enable the re-ranker (uses OpenRouter sonnet or DeepSeek flash)
CYBERINE_CANDIDATE_RERANK=true cyberine run --bg "add re-ranker to LocalBrain.boot()"

# Override top-N (default 5)
CYBERINE_CANDIDATE_RERANK=true CYBERINE_CANDIDATE_RERANK_TOP_N=3 cyberine run --bg "fix the config loader"

# Override the re-ranker model (default: anthropic/claude-sonnet-5 via OpenRouter, or deepseek-v4-flash direct)
CYBERINE_CANDIDATE_RERANK=true CYBERINE_RERANK_MODEL=deepseek/deepseek-v4-flash cyberine run --bg "..."

The re-ranker validates LLM output against the input candidate set — hallucinated file paths are silently dropped. Only paths present in the extractor + git-signal output are returned.