[codex] fail closed provider routing

[numnx]

Summary

Provider routing now fails closed when a selected or inherited provider instance is unavailable instead of silently falling back to another provider. This covers manual routes, agent-inherited routes, empty eligible pools, Jules-unavailable contexts, and CLI-only contexts.

Root Cause

Manual and inherited provider selections were filtered out when the selected provider instance was disabled or otherwise ineligible, then routing continued through fallback logic that could pick another enabled provider. The dashboard then masked the resulting routing failure as a generic Internal Server Error because provider selection errors were plain unexpected errors.

Changes

• Removed provider fallback behavior from invocation routing and task service dispatch.
• Added ProviderRoutingError and mapped it to a visible 409 dashboard/API response.
• Preserved generic masking for unexpected internal server errors.
• Updated backend coverage for fail-closed routing and visible provider-routing errors.
• Updated provider routing documentation and public provider/model docs.

Validation

pnpm run lint
pnpm run test:backend
pnpm run build

All passed locally.

Risk / Rollback

Risk is limited to provider-selection behavior becoming stricter. Operators with disabled or unavailable selected providers will now see a clear routing error and must enable the selected provider instance or choose a different route. Rollback is the previous fallback behavior, but that can dispatch work through an unintended provider.