Route Provider calls through one generation router

[SaladDay]

Provider calls used separate direct and node generation routers, while deployment loading and credential rotation lived in server callbacks. Route both modes through one sandbox generation router with fixed node proxies, and let execution own setup loading, monotonic publication, credential verification and call fencing. The server now composes those dependencies; RuntimeProvider is a plain value.

Preserves allocation ownership, operation declarations, retained generations, verification order, errors and logs. Removes the deferred loader/preparer/publication/credential callbacks and their presence checks. Handwritten production code decreases by 77 lines.

Validation: whole-module build/vet; 332 unit/subtest cases and 34 focused integration cases on the current cutover baseline, with zero remaining skips, including credential checks, workspace access, initialization binding and deployment recovery. Full database integration also passed: 377 top-level tests / 711 including subtests, with 20 official-SDK tests and one operator-binary test gated by unavailable local prerequisites. Runtime test gateways explicitly provide the Link authority required for Environment binding; existing assertions remain intact. Generation router/cache and node transport race tests passed 50 repetitions. OpenAPI freshness, naming and documentation checks passed. Fresh independent review found no substantiated in-scope issues; coordinator review confirms that integration with the current baseline preserves the code patch, gateway composition and workspace binding. No live provider acceptance was run because native adapter behavior is unchanged.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}