[rgarcia]

Summary

Adds OpenRouter as a third provider to the llm-credentials action, using OpenRouter's workload identity federation (docs).

• How it works: refresh_openrouter fetches a GitHub OIDC token with audience https://openrouter.ai (override with OPENROUTER_WIF_AUDIENCE). It exchanges that at https://openrouter.ai/api/v1/oauth/token with federation_policy_id, an RFC 8693 form-encoded request. The access token lasts at most 15 minutes, and never longer than the GitHub token.
• Where the token goes:
  • $OPENROUTER_ACCESS_TOKEN_FILE, for code that calls OpenRouter itself and rereads the file per request
  • the openrouter entry of pi's auth.json, so pi models on OpenRouter work too
• Several providers at once: start and refresh now take more than one provider, and the background loop refreshes all of them. A failing provider is logged and fails the call, but doesn't stop the others from refreshing.
• New action input openrouter-federation-policy-id: when it's set, OpenRouter is refreshed alongside the model's provider, and OPENROUTER_ACCESS_TOKEN_FILE is exported to later steps. This is for jobs whose pi model is on Anthropic or OpenAI but whose scripts call OpenRouter. It's also required when the model itself is openrouter/....
• stop also deletes the OpenRouter token file and the openrouter auth entry.

The first caller is kernel-tinker-rl's weekly maintenance job, whose WebJudge reward model calls OpenRouter. Existing callers are unaffected unless they pass the new input.

Testing

• scripts/test_llm_credentials.py: 19 tests pass, 5 of them new. They cover the exchange request shape, the token file mode, multi-provider refresh with one provider failing, keeping working credentials on failure, stop cleanup, and the action's provider selection.
• shellcheck passes.
• Not exercised live yet: the OpenRouter issuer and policy are being configured now. The tinker-rl weekly job run is the live check.

[rgarcia]

Picked tnsardesai to review: reviewed the earlier llm-credentials PRs (#41, #42)