feat: integrate Agentic-QE external providers

[pacphi]

Summary

• implement downstream support for Agentic-QE #628 and the external-provider surface released in Agentic-QE 3.13.12
• project admitted host-adapter providers into Agentic-QE through an agentic-kit-owned, verified-byte trampoline with earned grants, current consent, live reauthorization, bounded execution, minimal environment forwarding, and secret-safe failure handling
• make external defaults, fallback chains, activity routes, declaration/activation state, revocation, disablement, version downgrade, and explicit deselection converge project-locally with exact ownership receipts and stable repeated writes
• preserve foreign and user-edited router values, including a replacement default that was another member of a retired managed fallback chain
• document the manifest contract, six-tier graduation path, project-local lifecycle, operator commands, trust boundary, ownership rules, and upstream version requirement

Validation

• pnpm run check
  • typecheck
  • ESLint
  • markdownlint
  • package/build validation (175 shipped files; 208-file pack surface)
  • complete native test suite
• focused external-provider/host/config suite: 118/118 passed after the final ownership fix
• pnpm run test:aqe-external-provider-live: passed against installed Agentic-QE 3.13.12; real CLI + MCP JSON-RPC generation invoked the admitted provider
• git diff --check

Review evidence

Agentic-QE brutal-honesty review produced and this branch fixed weighted findings for stale provider snapshots (8/10), unbounded timeout/concurrency (7/10), and unbounded/control-bearing metadata (5/10), plus subsequent adversarial findings around environment casing, secret/output boundaries, revocation convergence, ownership drift, downgrade truthfulness, and write idempotence.

Final QE-Court receipt for 67bb0fb8444a43896b4064c3673b0b759b272c60:

• independent jury: SHIP, no surviving charges
• jury provider/model: OpenRouter / openai/gpt-4o
• advice hash: 2df1d3b7f8eb2dc70d29d1b8ac76022fc7ed7e2d744cd7e23786f2a03110b692
• overturn depth 1: UPHOLD (200/200 focused tests)
• overturn depth 2: UPHOLD (201/201 focused + live tests and an independent receipt-mutation matrix)

The final mutation matrix covers unchanged managed defaults; user replacements inside and outside the old chain; a second admitted external provider; null, malformed, wrong-provider, and wrong-hash receipts; and repeat byte/mtime stability.

Upstream boundary

This PR proves the supported Agentic-QE 3.13.12 MCP generation path. It deliberately does not claim aqe llm advise --provider <external>: upstream 3.13.12 constructs its ProviderManager before loading project external-provider configuration for that command. No downstream integration remains pending for the #628 MCP surface implemented here.