Harden AgentFanout worker dispatch routing

[SynapseOpsAgent]

Harden AgentFanout worker dispatch routing

Summary

• Enforces worker-first dispatch for broad investigations and blocks silent main-session fallback when fanout is unavailable.
• Adds explicit Codex cheap-worker runtime metadata so current-fast-mini launches mini/fast Codex workers instead of defaulting to a stronger model.
• Keeps MiniMax on the supported default selector unless highspeed support is explicitly verified.
• Adds no-pre-route-sweep guidance, stdin routing support, release-gate documentation, and regression tests.

Verification

• python3 tests/run_tests.py
• python3 -m py_compile scripts/route.py tests/run_tests.py
• scripts/github-preflight.sh
• targeted credential scan
• targeted voice/callback/webhook/TTS leakage scan

Security Notes

• No GitHub branch, PR, tag, release, or public export was created before this local gate.
• No dependency manifests were found in this repo, so dependency review is not applicable for this diff.
• Voice/callback/webhook/TTS terms are present only as prohibitions, sanitizer patterns, or tests.
• The fake sk-... value is an intentional regression fixture for secret hard-gate detection.