feat(mode): emit routing status as JSON

[tang-vu]

Summary

• add mode-switch.sh --status --json for a stable routing-mode receipt
• distinguish configured values from the local default and include the resolved env path
• preserve the existing human-readable status and switching behavior
• reject unsupported status-output options

Why this matters

mode-switch.sh --status is the documented read-only backend used before changing local, cloud, or hybrid routing. Automation can now determine the active source of truth without scraping colored prose or mutating .env.

Overlap check

Searched open and closed PRs for mode status json and PRs referencing ods/scripts/mode-switch.sh. Open PR #2626 adds switch previews, while #2616/#2767/#2864/#3076 change atomic writes; none adds a machine-readable status boundary. This PR changes only status reporting and its regression test.

Test plan

• bash ods/tests/test-mode-switch-status.sh (26 assertions)
• bash -n ods/scripts/mode-switch.sh
• git diff --check -- ods/scripts/mode-switch.sh ods/tests/test-mode-switch-status.sh

Tradeoffs and rollback

JSON mode uses the Python runtime already required by ODS to guarantee correct escaping. Removing the new optional flag fully restores the prior interface; switching semantics and .env writes are unchanged.

Generated with Codex

Batch compatibility

• Independently mergeable; tested combined in order feat(mode): emit routing status as JSON #3657 → feat(bootstrap): list hosted verification endpoints #3666.
• Base: upstream/main@6ff9b4fc; synthetic integration head: e45e2647.
• All focused public-boundary suites, the canonical generated-config JSON scan (12 surfaces), make lint, and git diff --check upstream/main...HEAD passed.
• tests/test-installer-context-parity.sh still fails at Hermes template bounds each model turn; the identical failure was reproduced on the exact upstream base, so it is not introduced by this batch.
• No live Docker mutation, model activation, migration, hosted deployment, or hardware validation is claimed.