Always use the same provider and never cross-provider

Same-provider invariant: worker/warmup model ALWAYS uses same provider as session. getWorkerModel(): effectiveProvider = cfg.model?.providerID ?? sessionProviderID ?? 'anthropic'; fallback chain: (1) cfg.model, (2) sessionModelID only if hasKnownDefaults, (3) WORKER_DEFAULTS[effectiveProvider], (4) undefined. Unknown providers → returns undefined. Cross-provider guard in pipeline.ts: detects model/upstream provider mismatch at prompt time, calls recordWorkerFailure('cross-provider') + returns null. Wire protocol resolved from resolveProviderRoute(providerID)?.protocol, NOT hardcoded. Workers must NEVER fall back to config().model — const model = input.model with NO fallback is correct. Any ?? config().model in worker code is a critical bug.