feat(provider-readiness): implement secure production-provider readiness boundary

[adamshen1007]

Summary

Implements FounderOS Milestone 14: Production Reasoning Provider Readiness and Secure Adapter Boundary Foundation.

This milestone adds a provider-neutral, non-executing readiness boundary that validates authorization, adapter policy, credential references, capability compatibility, trusted transport policy, rate and capacity controls, cost and budget controls, circuit state, observability retention, health derivation, deterministic dry-run request planning, and readiness-decision issuance.

The implementation intentionally stops before credential resolution or outbound provider transport.

Architecture

• Reuses the authoritative Milestone 13 durable Delivery and Invocation resolver.
• Preserves the knowledge-engine → knowledge-schema dependency direction.
• Adds no reverse dependency and no new runtime provider dependency.
• Keeps provider transport authority adapter-bound rather than caller-controlled.
• Maintains deterministic, redacted, fail-closed readiness evidence.
• Provides no live-ready or real-execution state.

Security and Invariants

• Exact, unexpired authorization evidence is required before credential or transport evaluation.
• Credential handling is reference-only; no credential values are accepted, loaded, stored, logged, or persisted.
• Trusted transport policy validates HTTPS, host, TLS, address, and request limits without caller authority replacement.
• Observability redaction occurs before bounded retention.
• Tampered, stale, reordered, substituted, aliased, or accessor-backed inputs fail closed.
• Production code contains no HTTP, DNS, TLS, socket, provider SDK, fetch, or provider-client execution path.
• Raw knowledge, query results, hidden context, low-level artifacts, callbacks, URLs, clients, and provider payloads cannot bypass the governed boundary.

Validation

• pnpm format:check
• pnpm lint
• pnpm build
• pnpm typecheck
• pnpm test
• git diff --check

Final local result before publication:

• 42 test files
• 1,038 tests passed
• 0 failed

An initial full-suite run encountered a filesystem-latency timeout in the migration suite. The migration suite subsequently passed 9/9 independently, and the exact full test command then passed cleanly.

Independent Review

Final whole-branch review result:

• Critical: 0
• Important: 0
• Minor: 0

Known Limitation

Retention-bound readiness-decision verification requires the same evaluator instance and a resident entry in the evaluator's four-entry FIFO issuance registry.

Explicitly Deferred

• Real provider integrations
• Credential resolution or secret loading
• HTTP or other outbound transport
• Persistent provider execution records
• Streaming
• Tools or function calling
• Agents
• Hermes
• MCP
• Provider routing or failover
• Distributed rate, budget, or circuit controls
• External observability systems
• User interface work

Review Gate

This PR must remain draft until an independent whole-PR review confirms:

• the pushed patch matches the reviewed local patch;
• CI passes;
• no scope expansion occurred;
• all architecture and security invariants remain satisfied.