v8.9.0-dev.11

• Merge pull request #1731 from kaitranntt/kai/fix-1728-openrouter-base-url
• Merge pull request #1730 from kaitranntt/kai/fix-cliproxy-backend-version-gates
• test(openrouter): refine regression test using existing profile-writer harness (#1728)
• fix(openrouter): use /api endpoint root to prevent duplicated /v1 (#1728)
• Merge remote-tracking branch 'origin/dev' into kai/fix-cliproxy-backend-version-gates
• docs: refresh hardening inventory after dev merge
• Merge remote-tracking branch 'origin/dev' into kai/fix-cliproxy-backend-version-gates
• test(cliproxy): strengthen fallback download url and ungated show/reset coverage
• chore(cliproxy): refresh formatting, throw-error baseline, and hardening inventory
• fix(cliproxy): fail-closed on unsupported drain-order priority selection (#1724)
• fix(cliproxy): correct pool routing version capability map (#1726)
• fix(cliproxy): correct ARM release asset architecture boundaries (#1725)
• feat(cliproxy): add meetsBackendMinimumVersion comparator helper