feat: verifier-gated model router (run cheap → verify → escalate)

## Summary
Add a verifier-gated model router: run a cheap model first, verify the result deterministically (`dbt build`), and escalate to a stronger model only when verification fails. Flag-gated (`ALTIMATE_ROUTER`), default off — the normal single-model path is unchanged.

## Motivation
Most data-engineering tasks are solved by a cheap recent model; only the minority that fail verification need a stronger (more expensive) model. Routing cheap-first with a deterministic gate keeps quality high while cutting cost, and attaches a machine-checkable verdict to each result.

## Scope
- `packages/opencode/src/router/` — `verifier`, `router`, `policy`, `verdict` (pure, unit-tested)
- `packages/opencode/src/cli/cmd/run.ts` — orchestration when `ALTIMATE_ROUTER=1`
- `packages/opencode/test/router/` — unit + env-gated E2E suites

The customer routing policy is served from a separate `altimate-backend` endpoint (tracked separately); this PR ships the client + static default.