fix(bandit): repair PairedModel when Thompson sampling switches model

[rohith500]

Summary

Bug: When x-weave-router-strategy: bandit Thompson-samples the cluster scorer's runner-up, bandit.Router rewrote Model but left Metadata.PairedModel pointing at that same slug. writeNewPin persisted {pinned_model, paired_model} as identical values, which silently disabled Stage 2 bandSwapServed for the pin's life (LARGE and SMALL resolved to one model).

Fix: On a real model switch, recompute the runner-up against the served model — same contract as banditexplore.repairBandPair. Argmax draws leave the scorer pair untouched.

Fixes #753

What changed

File	Change
internal/router/bandit/bandit.go	Call repairBandPair after annotate when TS switches off the argmax
internal/router/bandit/bandit_test.go	Regression tests with one-line behavior comments (AGENTS.md style)

Verification

Local (author):

• make check — all checks passed
• go test ./internal/router/bandit/... -race
• Stress 5000 trials on real testdata posterior: 0 collapses after fix (was 100% collapse on runner-up serves)

GitHub Actions (fork PR):

• Cursor Bugbot — pass
• Test / Comment Length / Cluster Routing — currently action_required (first-time contributor workflow approval). A maintainer needs to click Approve and run workflows on the PR checks tab before these can go green.

Checklist (CONTRIBUTING.md / AGENTS.md)

• Topic branch (not on main)
• Conventional Commits + DCO Signed-off-by
• Test comments state asserted behavior only (no issue/PR refs, no pre-fix narration)
• Linked issue

[greptile-apps]

PR author is not in the allowed authors list.

[devin-ai-integration]

Thanks for this, @rohith500 — subtle bug, nicely fixed. 🙏

When Thompson sampling serves the runner-up, the scorer's PairedModel was still computed against the old argmax and could collapse onto the served model; recomputing it against the served pick (repairBandPair) is the right fix. I read it against the repo conventions (AGENTS.md) and it conforms — no changes needed:

• Godoc — repairBandPair carries a clear doc comment, and the inline comment explains why the runner-up must be recomputed rather than restating the code.
• Package conventions — it follows the local internal/router/bandit style (the package deliberately keeps provider/model as plain strings and doesn't import internal/providers, so the test fixtures match).
• Tests — non-tautological: TestRoute_RepairsBandPairWhenServingRunnerUp asserts the pair is recomputed to the prior argmax (and doesn't collapse), and the argmax-keep case verifies the scorer's pair is left untouched.

Approving from a conventions standpoint — great find.