refactor(runtime): own provider-device admission behind a typed capability

[thymikee]

What

Gives the daemon its own typed capability for the one provider-runtime fact it decides on, so the daemon zone stops importing src/provider-device-runtime.ts from ten sites (#2541).

src/daemon/provider-device-admission.ts declares ProviderDeviceAdmission — one method, isActive(device) — defaults to the no-provider state every un-composed process already sees, and is installed by root composition at the site that already composes the provider request providers (src/daemon/server/daemon-runtime.ts). The predicate keeps its name, its per-call read, and the request-scoped ALS behaviour underneath it; the ten leaf call sites change only their import specifier.

Why a capability and not a re-export

A re-export would keep the same edge under a different filename. The seam is the point: the daemon names the fact it needs, root names where it comes from, and R76 now has exactly one daemon edge to that hub to classify (see the stacked gate PR).

Measured

	before	after
daemon production sites importing src/provider-device-runtime.ts	11 (10 leaves + the runtime composition)	1 (the composition only)
src/** production edges into that hub	12 pairs	2 pairs

The two remaining pairs are src/daemon/server/daemon-runtime.ts -> src/provider-device-runtime.ts (root composition, now classified in the R76 inventory) and src/core/interactors.ts -> src/provider-device-runtime.ts. src/core/interactors.ts keeps its edge: it also needs getProviderDeviceInteractor and sits below the daemon, so it cannot consume the daemon's seam. It is reached from the daemon only through the dynamic interactor lookup, which is now visible and classified with its own deepening issue (#2555).

Test seams

Nine daemon test files and the provider-scenario integration harness drive provider ownership through the root ambient scope. They now compose the admission the way daemon-runtime.ts does — one installProviderDeviceAdmission({ isActive: isActiveProviderDevice }) — instead of relying on the daemon reading root internals. Two vi.mock call sites retarget to the daemon module.

Validation

• pnpm test:unit — 1,282 files, 9,872 tests passed
• pnpm check:layering — OK (R76 inventory with the widened predicate on the stacked tip)
• npx vitest run test/integration/provider-scenarios — 66 files, 209 tests passed
• pnpm check:affected --run — all slices pass except mutation-model, whose scripts/mutation/ownership.test.ts "a kernel is owned by tests that reach it indirectly" failure reproduces identically on unmodified origin/main (3394d5b)

Part of #2541 (the src/core/interactors.ts edge and the interactor seam remain).

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.52 MB	4.52 MB	-119 B
Package (unpacked)	4.52 MB	4.52 MB	-119 B
Package (download)	1.33 MB	1.33 MB	-2 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	26.9 ms	26.9 ms	-0.1 ms
CLI --help	74.3 ms	74.7 ms	+0.4 ms

[thymikee]

No actionable findings on 32266c4. The composed delegate preserves per-call request-scoped ownership, and the router-level provider test covers the affected behavior. The remaining interactor seam is explicitly deferred to #2555. Current checks pass and there are no conflicts; ready for human review, with #2548 first in the merge order.