meta(warden): Use Grok 4.5 through OpenRouter

[dcramer]

Warden security reviews now use Grok 4.5 through OpenRouter instead of Claude Sonnet 4.6. The provider-qualified selector matches Pi's OpenRouter catalog and uses the existing WARDEN_OPENROUTER_API_KEY workflow credential.

[dcramer]

Once we merge ill delete WARDEN_MODEL in our github configs

[sentry]

Bug: Switching the LLM to Grok 4.5 may cause silent failures in the warden action if its output format differs from Claude Sonnet's, as parsing may fail silently.
_{Severity: MEDIUM}

Suggested Fix

Before merging, verify that the getsentry/warden@v0 action can correctly parse outputs from the Grok 4.5 model. This may require testing in a separate environment or inspecting the action's source code to ensure it's model-agnostic. If incompatibilities exist, either revert to the previous model or update the parsing logic within the action.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: warden.toml#L5

Potential issue: The configuration in `warden.toml` is changing the LLM from Claude
Sonnet 4.6 to Grok 4.5. The external `getsentry/warden@v0` action, which processes the
model's output, may have parsing logic tailored to Claude's specific response structure.
Since different LLMs can have subtle variations in their output format even when
API-compatible, Grok's responses might not be correctly parsed. Due to
`continue-on-error: true` in the workflow, a parsing failure would not cause the CI to
fail but would likely result in the `warden` action silently producing no findings,
effectively disabling the analysis.

_{Did we get this right? 👍 / 👎 to inform future reviews.}