Pin @quantum-l9/llm-router to a released tag/SHA (deferred from PR #1)

[cryptoxdog]

Context

router-shim/package.json pins @quantum-l9/llm-router to the moving #main ref, which makes builds non-reproducible (raised by Copilot on PR #1).

Why deferred

Pinning to a tag/commit SHA requires reading the upstream Quantum-L9/LLM-Router repo, which is outside this session's repository scope and not fetchable from the actuation sandbox. Inventing a SHA is not acceptable.

Proposed resolution

Once @quantum-l9/llm-router publishes a released tag (or a stable commit is chosen), update router-shim/package.json:

"@quantum-l9/llm-router": "github:Quantum-L9/LLM-Router#<tag-or-sha>"

Until then the shim builds from #main deliberately so the bridge tracks the still-moving upstream contract (see ADR 0001 for the contract surface).

Acceptance

• router-shim/package.json references an immutable ref (tag or full SHA).
• router-shim/setup.sh still builds dist/index.js from that ref.

[cryptoxdog]

Resolved in #18 (branch claude/resolve-issues-14-16).

Fix: router-shim/package.json now pins @quantum-l9/llm-router to an immutable full commit SHA:
github:Quantum-L9/LLM-Router#87075d8228f2ac0e16056894cc4f5c8335498f17 (no longer #main).

Upstream Quantum-L9/LLM-Router was verified live — public and accessible, but has no releases and no tags — so per the preferred-ref order a full 40-char SHA (the verified default-branch HEAD) is used. SHA existence confirmed via the GitHub commits API.

Acceptance verified:

• package.json references an immutable ref (full SHA).
• setup.sh still builds dist/index.js from that ref — validated end-to-end (npm install from SHA + tsc → dist/index.js present, exit 0). CI Lint / Types / Tests green on Resolve router pin and SonarCloud security follow-ups #18.

Auto-closes on merge of #18 (Fixes #14).