Add AmbientContextProviderInterface for Strict strategy

[oojacoboo]

Summary

• Adds AmbientContextProviderInterface — a marker interface for context providers that represent always-on environmental state (e.g., "any role active", "user logged in")
• Strict strategy now skips ambient providers during coverage checks, preventing universal denial from meta-contexts
• Fully backward-compatible — existing providers default to being checked

Context

FilterStrategy::Strict denies access when an active context isn't covered by any filter. But meta-contexts like role (always true when authenticated) and user (always true when a user is on the stack) are never listed in filter context: arrays — they'd cause every query to be denied, including managers.

Test plan

• testStrictAmbientContextIsSkipped — ambient providers active but skipped, no denial
• testStrictAmbientContextDoesNotMaskUncovered — ambient skipped but non-ambient uncovered context still triggers denial
• All 48 tests pass