Smart (LLM-as-router) for low-confidence tasks (T61)

When the deterministic router is unsure about a task (confidence < 0.7 — the "default fallback" bucket), you can opt in to a secondary LLM call that refines the worker ordering and per-worker model selection using model-knowledge context. The LLM pick is validated against the real available worker ids and the model catalog; hallucinated ids are dropped and the decision falls back to deterministic on any error, timeout, or empty result.

The feature is off by default — the deterministic path is always the zero-cost default. Enable it only when routing quality for ambiguous prompts matters more than the extra latency and token spend of one extra cheap model call.

# Enable the smart router (uses OpenRouter or DeepSeek for the router call)
CYBERINE_SMART_ROUTER=true cyberine route "analyze this code"   # confidence 0.5 -> LLM call
CYBERINE_SMART_ROUTER=true cyberine run --bg "analyze this code"

# A clear task skips the LLM router even when enabled (confidence >= 0.7)
CYBERINE_SMART_ROUTER=true cyberine route "fix typo in auth.ts"  # confidence 0.7 -> deterministic

# Use a different model for the router call (default: deepseek/deepseek-v4-flash via OpenRouter)
CYBERINE_SMART_ROUTER=true CYBERINE_ROUTER_MODEL=deepseek/deepseek-v4-pro cyberine route "analyze this"

# Use DeepSeek-direct instead of OpenRouter for the router call
CYBERINE_SMART_ROUTER=true CYBERINE_ROUTER_BASE_URL=https://api.deepseek.com CYBERINE_ROUTER_API_KEY=$DEEPSEEK_API_KEY CYBERINE_ROUTER_MODEL=deepseek-v4-flash cyberine route "analyze"

The cyberine route dry-run shows source: deterministic or source: llm and the LLM's one-sentence reasoning (when it was invoked). The --json flag includes source and llmReasoning in the output for programmatic consumption.

Fallback contract: the LLM router can only re-order workers already selected by the deterministic router — it cannot pick unavailable workers, bypass pool/cost rules, or inject workers outside the available set. Any hallucinated worker or model id is silently dropped.