feat(gateway): decision-only degrade + --config/WAYFINDER_CONFIG (desktop backend enablers)

[tcballard]

Summary

Two small, backward-compatible gateway enablers for the macOS desktop app (WF-ADR-0042), each also
useful on its own. Both keep the deterministic decision offline (WF-ADR-0001) — no model call, key,
or network enters the scored path.

1. Decision-only degrade. A live gateway with no [gateway.models] configured now answers
   /v1/chat/completions with the routing decision ({"wayfinder": {…, "decision_only": true}}
   plus an x-wayfinder-router-decision-only: true header) instead of a 500. This is the
   onboarding floor: you see real routing the instant the gateway starts — before wiring any backend
   — and a client can render decisions while a local model (e.g. Ollama) is still warming up. The
   decision is computed by the same offline path as --dry-run, so it is byte-identical to it.

2. serve --config / WAYFINDER_CONFIG. Point the gateway at a specific wayfinder-router.toml
   instead of relying on the working-directory walk-up, so a launchd / systemd gateway (whose cwd is
   unpredictable) and the desktop app can share one well-known file. service install --config PATH
   bakes it into the unit. Precedence: --config → WAYFINDER_CONFIG → cwd walk-up → defaults.

Scope

Included

• gateway.py: the no-models → decision-only branch — gated strictly on an empty model set, placed
  after the --dry-run return (which keeps its own dry_run flag) and before the endpoint lookup;
  plus the updated no-models boot warning.
• config.py: WAYFINDER_CONFIG precedence in find_config_file (a set-but-missing override is a
  clear None, never a silent walk-up).
• cli.py: serve --config, service --config, and _resolve_serve_args(host, port, config=None).
• Tests: test_gateway.py (3), test_config.py (3), test_service.py (2).
• CHANGELOG.md entries under ## Unreleased.

Excluded

• The desktop app itself (Tauri shell, React popover, sidecar) — ships on its own desktop-v* lane.
• The WF-ADR-0042 document — lands with the desktop app; these enablers reference it forward.
• Any change to the deterministic scorer, or to the offline-first / circuit-breaker 503 path
  (a genuine outage — models configured but all cooling down — still returns its 503; a
  misconfigured tier still 500s).

Verification

ruff check . && mypy wayfinder_router && pytest -q:

ruff: PASS
Success: no issues found in 23 source files
576 passed, 1 warning in 6.91s

Decision-only — a live gateway with no models, from a clean config (no upstream is contacted):

HTTP/1.1 200 OK
x-wayfinder-router-model: local
x-wayfinder-router-score: 0.00
x-wayfinder-router-decision-only: true
body.wayfinder: {'model': 'local', 'score': 0.0, 'decision_only': True}

--config / WAYFINDER_CONFIG loading a fixed file from a foreign cwd (/, where the walk-up finds
nothing):

serve --config …   :8090/healthz -> {"status":"ok","models":["tinyllama"]}
WAYFINDER_CONFIG=…  :8091/healthz -> {"status":"ok","models":["tinyllama"]}

[tcballard]

Status: not rebaseable against current main.

Since this PR was opened, main migrated to a Rust-only runtime and the wayfinder_router/ Python package was removed. .github/workflows/ci.yml now leads with a job that fails any PR reintroducing wayfinder_router, pyproject.toml, uv.lock, or requirements.txt.

This PR changes wayfinder_router/gateway.py, config.py, and cli.py, so the conflict shown above isn't resolvable in the usual way — even a clean rebase would be rejected by that boundary gate. The passing checks are from a July CI configuration that no longer exists.

Both enablers still look worth having in the Rust gateway if they aren't already covered there:

1. Decision-only degrade — a live gateway with no configured models answering /v1/chat/completions with the routing decision plus x-wayfinder-router-decision-only: true, instead of a 500. Still the right onboarding floor.
2. serve --config / WAYFINDER_CONFIG — an explicit config path for launchd/systemd gateways whose cwd is unpredictable, with --config → env → cwd walk-up → defaults precedence.

Leaving this open pending a decision on whether to reimplement against the Rust gateway or close it as superseded.

---

Generated by Claude Code