Separate model failure telemetry from valid ambiguity
A fail-closed router may send neither on valid ambiguity nor on an inference outage, but those outcomes must remain operationally distinct. Return a typed bounded result such as selected, ambiguous, or failed; log only safe categories for timeout, provider error, incomplete outpu…