feat(provider): surface dual-host role delegation + qe-court routing awareness

[pacphi]

Summary

Closes #36. ak x provider already wires ruflo's dual-host env flags and agentic-qe's fallback chain, but had zero awareness of capability one layer up — this PR surfaces it without reimplementing any of it.

• Phase 1 — guidance tips (role-delegation pointer to claude-flow-codex dual run --template ..., judge-vendor-bias note) printed once both hosts are enabled, in both pick and status.
• Phase 2 — the interactive aqe-fallback prompt now suggests a claude-code:...; openai:... chain when codex is among the chosen hosts (codex's models route through the openai provider type).
• Phase A/B/C (same-day issue amendment, qe-court/ADR-124, agentic-qe >= 3.13.0):
  • A: cross-sell tip when both hosts are enabled and aqe is new enough.
  • B: read-only routing table + invariant pass/fail in status.
  • C: opt-in [y/N] write of routing defaults in pick, validated against the same vendor-diversity / writer-is-never-juror invariants qe-court's own referee.ts enforces (ported into new src/lib/qeCourt.mjs). Only ever defaults an existing .claude/skills/qe-court/config.json — never creates one, and only ever touches the routing key.
• Phase 3 (per-agent-type provider override) — spiked, not built. Read agent-router-config.d.ts / overlay-schema.d.ts / config-store.js off the installed agentic-qe@3.13.0 package directly: the override mechanism in agent-router-config.ts is 100% programmatic (in-memory Maps, no file I/O), and the BMAD-002 .claude/agent-overrides/*.yaml schema — while a real, stable on-disk surface — has no provider/model field at all (it's content/behavior-only). Closing as "not exposed yet upstream" per the issue's own stated fallback; will re-open if that changes.

Test plan

• pnpm run check (typecheck + lint + markdown lint + build + full test suite) — clean, 169/169 tests pass
• New unit tests: bothHostsEnabled/suggestedFallbackFor (providers.test.mjs), vendorOf/panelFromRouting/validatePanel/readQeCourtConfig (qeCourt.test.mjs, porting qe-court's own referee.js test cases)
• New CLI-spawn smoke test (provider-cli.test.mjs): ak x provider status prints the tips once both hosts are enabled, and withholds them with only one host — run in an isolated XDG_CONFIG_HOME/HOME sandbox so it never touches the real machine's kit.json
• Manually verified ak status on this repo shows no leftover corrupt-lock language (unrelated regression check, confirms nothing here touched that path)

🤖 Generated with Claude Code