feat(route): give the advisor a writer, on a need and per row

route.sh now emits `--advisor opus` into the startup command it prints.
The flag existed and worked, but nothing generated it, so it went unused:
the only mechanism that ever set an advisor here was `/advisor`, which
writes the global advisorModel setting -- every session, every repo -- and
was abandoned for burning quota. Nothing replaced it.

Two independent triggers, almost disjoint by construction:

  rows 1-2  always. Sonnet main model, so opus is a capability LIFT rather
            than a peer. Load-bearing: every fallback is one row cheaper and
            the cheap rows are Sonnet, so this makes the quota fallback safe.
  rows 3-4  only at reversibility=costly|one-way. Opus main model, so the
            advisor buys peer review where a mistake is not cheap to undo.
  rows 5-6  never. The CLI rejects every advisor for a Fable main model.

costly forces row 3 and one-way forces row 4, so a Sonnet row always has
reversibility=cheap and neither rule reaches the other's rows.
verification=none is deliberately not a third trigger: beyond the stakes
rule it adds only cheap-to-reverse mistakes, docs sessions among them.
Applied per ROW, so fallback-command carries its own correct answer.

route-selftest.sh 56 -> 73. Section 14 gates the three CLI facts the rule
rests on against the installed claude without spending a token: advisor
validation runs before the empty-prompt check, so `-p ""` reaches the
validator and stops. --help cannot gate this -- it short-circuits before
option validation, so an unknown flag would pass the gate untested.

Three pre-existing checks updated rather than worked around: two asserted
whole command strings that now carry the advisor, and section 11's effort
extraction swallowed the tail of the command line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X8N8hQEJSWWtieWUx37txT

CLAUDE.md

@@ -59,7 +59,7 @@ marketplace plugin. Three components, one boundary:
   rationale, and prints one block of `key=value` lines: the rubric row, the rule
   that fired, the `next-cost` value, a pasteable startup command, the one-row
   cheaper fallback, and the STATE.md comment lines. Pinned by
-  `route-selftest.sh` (56 checks).
+  `route-selftest.sh` (73 checks).
 
   **It is here because it is the WRITER for the field `board.sh` already reads.**
   `next-cost` had a reader and no writer, so it was hand-typed every session and
@@ -77,6 +77,24 @@ marketplace plugin. Three components, one boundary:
   and belongs to the skill; turning scores into a row is a lookup and takes zero
   model calls.
 
+  **`--advisor opus` is emitted per ROW, on a need, never unconditionally.**
+  Rows 1-2 always carry it (Sonnet main model, so opus is a capability lift —
+  and since every fallback is one row cheaper and the cheap rows are Sonnet,
+  this is what makes the quota fallback safe to take); rows 3-4 only at
+  `reversibility=costly|one-way` (Opus main model, so it buys peer review where
+  a mistake is not cheap to undo); rows 5-6 never, because the CLI rejects every
+  advisor for a Fable main model. The alternative — the global `advisorModel`
+  setting written by `/advisor` — is what this replaces: it applies to every
+  session in every repo, which is how it burned quota before. The two triggers
+  are almost disjoint by construction, since `costly` forces row 3 and `one-way`
+  forces row 4, so a Sonnet row always has `reversibility=cheap`.
+  `verification=none` is deliberately NOT a third trigger: beyond the stakes
+  rule it would only add mistakes that are cheap to reverse, docs sessions
+  (`known/none/cheap/local`) among them. Section 14 pins the rule and gates the
+  three CLI facts it rests on against the installed `claude` without spending a
+  token — advisor validation runs before the empty-prompt check, so `-p ""`
+  reaches the validator and stops there.
+
   **`--last-effort` is MEASURED from `CLAUDE_EFFORT`, and the calculator must
   never default it.** Claude Code exports that variable into every tool-use
   context as the session's current effort, so the caller reads it and passes it
@@ -137,7 +155,7 @@ obligations in another repo.
 - TDD: no behavior change without a failing selftest check first.
   `bash scripts/coord-selftest.sh` must exit 0 (159/159),
   `bash scripts/board-selftest.sh` must exit 0 (36/36) and
-  `bash scripts/route-selftest.sh` must exit 0 (56/56).
+  `bash scripts/route-selftest.sh` must exit 0 (73/73).
 - English for all code, docs, and commit messages (public repo). Norwegian
   trigger aliases in the skill description are deliberate.
 - Conventional Commits: `type(scope): description`.