feat(fusion): batch trim by turn policy, claims need evidence, worker limits and hand-back, reasoning caps, cloud worker cap, pinned request (F8, F9, F19–F22)

[plombeer31]

What

Before: the batch trim kept the first approval-gated call in emit order without asking the fusion gate, so [os.shell.run mkdir, fusion.delegate] kept the refused mkdir and dropped the delegation (9 minutes of local generation redone); a reply could claim "node --check on all files (all passed)" after a one-file check or no check at all; every worker had 40 steps and 45 minutes regardless of model speed, and a worker that wrote nothing spent all of it; no reasoning effort or output cap was ever sent for workers (87 % of one fan-out's output was hidden reasoning); the cloud worker pool was infinite and /runmode status printed the default rather than what runs; an earlier task's request could fall out of the prompt during a repair.

After: wouldRefuse / refusedToolNames on the fusion gate drive the trim (refused calls dropped first, fusion.delegate preferred in an orchestrator turn) and the notice names why each call was dropped; a shell node --check a b c warns that only the first file was checked, and a final reply claiming a check with no matching call gets one ### notice and one more step; the worker time limit is derived from measured tok/s and the declared output (clamped 10–45 min, cloud keeps 45), and a task with declared files and no write by half its budget returns needs_orchestrator with what it found; llm.runMode.fusion.workerReasoning and workerMaxOutputTokens reach the provider body (reasoning: {effort} on OpenRouter, reasoning_effort on openai-compatible) and the status table shows the fan-out's cloud spend; llm.runMode.fusion.cloudWorkers caps a cloud fan-out, the machine facts use the live slot count in external mode, and /runmode status says what will run; a ### request section (≤ 16,000 chars) is rendered right before ### conversation once the packer has dropped the turn that carried it. Config bump for the new fields.

Why

Design call D4 (early hand-back). Keep one shared predicate for the gate and the trim or they disagree and drop the wrong call. The claim check is one notice per turn, never a blocked reply, and matches only claims about this turn. Includes the reconcile commit that removes a duplicated wouldRefuse / FusionGateContext declaration, a duplicated reasoningEffort field on CompletionRequest, and renames the OpenRouter subclass's kind option to providerKind.

How it was verified

• npm run lint clean
• npx vitest run --minWorkers=1 --maxWorkers=3 src/agent src/config src/llm src/llm/provider src/llm/provider/openai src/llm/provider/openrouter src/llm/run-mode src/prompt src/runtime/bootstrap.test.ts src/runtime/llm-fallback-seam.test.ts src/runtime/llm-link-attempt.test.ts src/tools/fusion src/tools/os src/tracing/trace src/tui/agent-event-reducer.test.ts — 244 files / 3516 tests green, 3 skipped (baseline failures: none)
• verified live: a worker that declared files and wrote nothing by half its budget came back needs_orchestrator instead of ok (the F19 hand-back, later tuned in PR 14)

Stacked on #433; merge in order.