feat(runner): wire llmSource selection and trace stamping

internal/runner/source.go

@@ -4,8 +4,10 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"log/slog"
 
 	"github.com/priyanshujain/sanderling/internal/driver"
+	"github.com/priyanshujain/sanderling/internal/openrouter"
 	"github.com/priyanshujain/sanderling/internal/verifier"
 )
 
@@ -61,12 +63,33 @@ func (s webSource) ExtractorOverrides(ctx context.Context) (map[int]json.RawMess
 }
 
 // pickSources selects the runtime's action and extractor sources ONCE at setup
-// from the driver's capabilities, so the step loop never type-asserts.
-func pickSources(options Options) (ActionSource, ExtractorSource) {
+// from the driver's capabilities and the spec, so the step loop never
+// type-asserts. When the spec selected the LLM action backend (actions =
+// llm({...})) it constructs the OpenRouter client and returns an llmSource for
+// selection while extractor overrides still come from the goja path.
+func pickSources(options Options) (ActionSource, ExtractorSource, error) {
 	if web, ok := options.Driver.(driver.WebDriver); ok {
 		source := webSource{web: web}
-		return source, source
+		return source, source, nil
+	}
+	if config, ok := options.Verifier.LLMConfig(); ok {
+		client, err := openrouter.New()
+		if err != nil {
+			return nil, nil, fmt.Errorf("llm action backend: %w", err)
+		}
+		logger := options.Logger
+		if logger == nil {
+			logger = slog.Default()
+		}
+		action := &llmSource{
+			verifier: options.Verifier,
+			client:   client,
+			model:    config.Model,
+			logger:   logger,
+			history:  newActionHistory(llmHistorySize),
+		}
+		return action, gojaSource{verifier: options.Verifier}, nil
 	}
 	source := gojaSource{verifier: options.Verifier}
-	return source, source
+	return source, source, nil
 }