feat(core): enforce managed provider policies

[adamdotdevin]

Issue for this PR

Paired with https://github.com/anomalyco/opencode-console/pull/2191.

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Applies Console organization rules after authored policies at catalog reads and model resolution. Protects the managed loader from plugin-removal directives and binds snapshots to the active connection.

Revision-zero defaults work without policy publication. A cold-start config failure blocks all normal providers, even for an org with no custom rules; transient refresh failures retain a valid same-identity snapshot. Console's contract must deploy before this client. The availability tradeoff is called out in the spec.

How did you verify your code works?

• 155 tests across policy, config, provider, model, catalog, session, and supervisor suites; 10 matcher tests.
• Full 35-package typecheck with the required Bun 1.4.2.
• Paired Console browser/API/MySQL run passed and exercised this real loader; matcher/fixture conformance passed.

Screenshots / recordings

N/A: runtime changes.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR