Class C11 (provider/model routing + credential resolution). One real
loopback OpenAI-compatible host per provider identity, each accepting only
its own key; every scenario configures all identities and only changes the
selection, and one invariant runs after every leg: requests land only on the
selected hosts, each with only that host's key, the user sees that host's
answer, and nothing egresses to a real inference API (CONNECT trap).
Real `hermes chat -q` / `hermes -z` subprocesses cover custom base_url
(key_env / literal), bare custom fail-fast, named providers: and legacy
custom_providers entries, startup -m aliases (#103933/#107191/#109440),
fallback after 401/429, credential pool rotation / single-key exhaustion,
per-profile routing, aux title + delegation routing. The real stdio
tui_gateway walks mid-session /model switches incl. pool recovery without
restart.
fake_llm_provider: api_key may be a list of accepted keys (pool on one
host) and opt-in record_get; defaults unchanged.
(cherry picked from commit bf1f07571d7777fe91b16f386e026c12bdbfe73b)
616e8d4df6