v0.19.8 — provider-gateway hardening

The 16th adversarial review swept the provider gateway (LLM failover / key rotation / retry / cost / cache) and found 4 real bugs, 1 HIGH. All fixed with regression tests.

Fixed

• 🎯 The completion cache no longer defeats consensus checks (HIGH). It served temperature>0 samples, so k identical sampled requests returned byte-identical content — collapsing cascade agreement, the fusion router's agreement gate, and self-consistency into fake unanimity (false confidence). The cache now serves/stores only deterministic (temperature==0) requests.
• An empty-content result is no longer cached — one malformed response would otherwise serve "" forever at $0 for that key.
• acomplete() now honors the credential pool — a pool-only config (CHIMERA_OPENROUTER_KEYS with no single *_API_KEY) previously AUTH-failed.
• The lazy key-rotator creation is lock-guarded against the fusion panel's threads.

The failover taxonomy, key rotation/cooldown, cache-hit $0 accounting, cost-on-actual-model-after-failover, atomic cache writes, streaming reassembly and budget clamp all reviewed clean.

Gate: 1468 passed / 4 skipped, mypy + ruff green.

Upgrade: `pip install --upgrade 'chimera-agent[full]'`