fix(OperationsCenter): honor allowed-provider gate in worker-backend fallback

[ProtocolWarden]

Summary

• worker_backend_selector remote backend candidate selection now honors OPERATIONS_CENTER_ALLOWED_PROVIDERS; when policy disallows alternates such as codex_cli, no fallback candidate is returned.
• Root cause: claude_code was in cooldown and gated to claude-only by policy, but the selector silently fell through to codex_cli anyway, producing repeated Stage planner received non-JSON from agent (session limit or error) failures on the goal lane (observed across 2026-07-15 watchdog cycles).

Test plan

• pytest tests/unit/backends/test_worker_backend_selector.py tests/unit/backends/test_worker_backend_selector_cov.py -q → 48 passed
• pytest tests/unit/er000_phase0_golden/ -q → 15 passed