fix(core): preserve routing rejection explanations

[robinbraemer]

Intent

Make codex-router the reusable routing source of truth for AgentOS without losing observability. Preserve the router's already-computed per-account ineligibility explanations in its typed NoEligibleAccountsError so AgentOS can report exact quota, health, block, and reauthentication rejection reasons without duplicating selection policy. Keep the change bounded to the Effect-based core contract and tests, preserve current routing behavior, and deliver it as a merge-ready reviewed PR with full repository checks and CI.

What Changed

• Preserve the complete per-account CandidateExplanation array in NoEligibleAccountsError for both no-eligible selection paths.
• Document the reusable core contract and extend selection coverage for quota, health, block, freshness, reset, and reauthentication rejection reasons.

Risk Assessment

✅ Low: The change is narrowly scoped and correctly carries the computed candidate explanations through the typed core error without altering successful routing behavior.

Testing

The missing local dependency was restored, focused selection and routing tests were exercised, the typed-error test was expanded to cover all relevant rejection categories, and a reviewer-visible JSON artifact was captured. No actionable findings remain.

Evidence: Selection explanation payload

NoEligibleAccountsError preserved 7 exact per-account rejection reasons across reauthentication, block, usage, and quota cases.

{
  "_tag": "NoEligibleAccountsError",
  "message": "No account has safe quota and health data",
  "explanations": [
    {
      "accountId": "reauth",
      "eligible": false,
      "rejection": "reauthentication_required"
    },
    {
      "accountId": "blocked",
      "eligible": false,
      "rejection": "active_block"
    },
    {
      "accountId": "unknown",
      "eligible": false,
      "rejection": "usage_unknown"
    },
    {
      "accountId": "short-exhausted",
      "eligible": false,
      "rejection": "short_headroom"
    },
    {
      "accountId": "weekly-exhausted",
      "eligible": false,
      "rejection": "weekly_headroom"
    },
    {
      "accountId": "too-old",
      "eligible": false,
      "rejection": "usage_too_old"
    },
    {
      "accountId": "expired-reset",
      "eligible": false,
      "rejection": "weekly_reset_elapsed"
    }
  ]
}

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• bun install --frozen-lockfile
• bun test packages/core/test/selection.test.ts
• bun test packages/core/test/selection.test.ts packages/core/test/routing.test.ts
• Manual core API invocation producing NoEligibleAccountsError JSON

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.