feat: Unified Provider Interface — lifecycle hooks + context injection API

[Pizzaface]

Summary

This PR currently collects the unified provider-interface work plus follow-up hardening that landed while stabilizing the branch.

Main provider API work

• Adds ExtensionProvider types, capability guards, and config schema for provider services.
• Adds provider discovery/loading from user and project provider directories with trust-gated project providers and per-provider enable/disable config.
• Adds ProviderBridge aggregation with deterministic ordering, per-prompt dedupe, error isolation, and provider disable-on-repeat-failure behavior.
• Wires a provider Pi extension into the daemon extension chain so providers can react to session/turn lifecycle events and inject context into prompts.
• Documents the Extension Providers API in the docs site and updates runner-service skill guidance.

Follow-up hardening included on the branch

• Adds session finalization reducer coverage for safer streamed/session-close state handling.
• Wires session-close finalization into daemon archival paths.
• Hardens hook/browser notification behavior.
• Fixes tunnel streaming/rollback paths and related server/tunnel tests.
• Adds UI error-boundary and browser-notification coverage.

Key design decisions

• Provider capabilities are duck-typed so providers can implement only the surfaces they need.
• Context contributions are sorted by order and providerId for deterministic prompt placement.
• dedupeKey deduplication is scoped per prompt and resets on prompt boundaries.
• Provider failures are isolated: repeated failures disable that provider for the rest of the session instead of breaking the whole run.
• Project-local providers require an explicit trust gate and default off.

Verification

Fresh local verification on this branch:

• bun run typecheck — passed
• bun run test — 988 pass, 1 skip, 0 fail
• bun run build — passed
• git diff --check origin/main...HEAD — passed
• Branch sync: git pull --rebase and git push both reported up-to-date

Notes

• Existing ServiceHandler services continue to work; the provider API is additive.
• Pertinence is expected to be the first external consumer of this API.