#936 Every LLM route is dead: agent route models retired/unpaid, DeepSeek key empty

EARS SPEC: - Every route in [llm.routes] and default_route shall contain at least one model that answers a live probe with HTTP 200 using the keys the workers actually hold. - When an agent run starts, the agent route shall complete at least one LLM turn including a tool call. - If a configured provider has no API key in the worker environment, then that provider shall not appear in any route. FOUND 2026-10-15 via highway-mcp measurement runs 4a3ae581 / 5945b467 (failed in 2s, 'Task permanently failed after exhausting retries'). Probe from worker with the engine's own keys: ollama/glm-5:cloud 410 (retired 2026-07-15), ollama/qwen3.5:397b-cloud 410 (retired 2026-09-25), ollama/minimax-m3:cloud 402 (not in our Ollama Cloud plan), DEEPSEEK_API_KEY empty in worker env (deepseek/* routes cannot authenticate). Only working model: ollama/gemma4:31b-cloud (200, tool call verified). SYNTHESIS: single-line chore - solution domain is LLM router config; concept: route = ordered fallback chain, every element must be live. Alternatives: (a) gemma4 only now [CHOSEN, only verified-live model]; (b) buy Ollama Pro / supply DeepSeek key [user decision, cost]. SECONDARY GAP: workflow error exposes only 'exhausting retries' + internal task id; the cause (all candidates 402/410) is invisible through the API. Separate ticket.