The validator user-simulator runs on mistralai/mistral-small-2603, which has
been rate-limiting (429) on OpenRouter and hard-failing episodes. When the
inference proxy sees that model on OpenRouter it now injects an OpenRouter
`models[]` candidate list [mistral-small-2603, qwen3-30b-a3b-instruct-2507] so
OpenRouter fails over to Qwen on a primary 429/5xx.

The scalar `model` stays Mistral, so the existing allowlist check still validates
the primary; the injected fallback is proxy-hardcoded (not client-steerable), so
the #260 strip (which blocks a *client* steering onto an unvalidated model) does
not apply — its threat model is client-supplied routing fields, not this.

Smallest change to unblock: no validator/runtime release, no pack regen, no
allowlist change. OpenRouter only.

Follow-up (not this PR): replay-parity Mistral-vs-Qwen on the sim + record the
served model — cross-validator fallback timing adds score variance (cf. the
alignment-gate variance in ORO-2334).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>