feat(generate): optional OpenRouter pool R and the ox lanes

[atyrode]

Adds Ox Alpha (openrouter/stealth/ox-alpha) as the first member of an optional third pool, R (OpenRouter).

Design

• Catalog presence is the on/off switch. No new dial, no new keybinding: a full R tiers-1..3 ladder in models.yml generates two lanes — ox-only (every role on the free pool, advisor included) and ox-led (the free pool leads default/task/utility/vision; plan/slow/designer/reviewer cross to Anthropic; fable may still lead those). No R models → the lanes are never generated and the lane dial never offers them; a half-declared ladder is refused at load.
• One-model family encoding. The same id is declared once per tier with ascending thinking ceilings (low→low, low→high, low→max), so the tier dial means thinking depth. Existing holed-scale clamps (clampTh rounds down) do the rest; validators accept the repetition unchanged.
• Validity mirrors. genValid gates spark/fable/main per lane; comboID clamps identically so manual cycling can never land on a missing combo; repairConstraints enforces the same rules on ctrl+o proposals.
• Pool-aware provider prefixing. __models__ rows gain a trailing pool column; prefixed() uses it (R → openrouter/…) with the old name heuristic kept for catalogs that predate the column.
• Rendering. modelRe now matches provider-scoped ids (stealth/ox-alpha:high, and local vendor/model ids too); ox tokens and lanes read green (#1f9d5b / #5fce96); rendered chains dedupe tokens that clamp to the same id:level; listW's 80-cell cap yields to the wider lane row instead of clipping dial options.
• Runtime parity (presentation only). A selected runtime target now renders in the same routing grammar as hosted profiles — every role the broker's profile routes, at the dialed thinking — with an honest cost free · local inference footer line instead of meters. The broker boundary is untouched: acquisition, provisioning, and profile ownership stay with the runtime.

Out of scope, deliberately

• Usage-panel integration for OpenRouter (credits, not windows — fails soft today).
• v-panel/API-key governance: there is no enforcement seam for API-key credentials in the launch path, so a toggle there would be decorative.
• code generate init scaffolding of pool R (curated by hand; init --refresh rewrites wholesale and drops cost_in <= 0 models).

Verification

• Full suite green (go vet, gofmt, go test), including new coverage: ladder all-or-nothing, lane gating, ox routing policy (structural, not golden), advisor ox context, modelRe/shortModel/prefixed/trimLanes.
• Headless TUI verification (tmux, truecolor env per tui-visual-verification): 7-value lane row unclipped at 150 cols; ox-only hides fast/spark/fable/main and routes every role to ox-alpha with thinking-tier variation; ox-led keeps the free pool on high-volume roles with Claude on deliberative/advisor; ox tokens paint in the green family; frame bottom (usage footer + help rule) intact.
• End-to-end code generate on an ox fixture: 127 combos, advisors table gains the ox context, __models__ carries the pool column.

Data (the models.yml entries) lands in atyrode/dotfiles after this ships and the pin bumps — today's pinned release rejects pool R.