feat(providers): add secret-safe embedding routes

[fishmingyu]

Summary

Introduce the first half of #419: one secret-safe inference route and embedding artifact compatibility boundary for local Hugging Face and BYO OpenAI-compatible providers.

GitHub Models was retired by GitHub on 2026-07-30. This PR explicitly rejects its former aliases instead of publishing an unavailable route.

Changes

• Add canonical provider/model/endpoint resolution, redacted credential discovery, and stable public compatibility fingerprints.
• Split vector artifact identity from process-local credentials and operational knobs.
• Persist schema-v3 route identity and validate provider output dimensions.
• Reopen vector artifacts through their persisted route; reject silent provider or endpoint substitution.
• Preserve schema-v2 artifact loading while validating schema-v3 fingerprints.
• Support local Hugging Face and generic OpenAI-compatible embeddings.
• Reject retired github_models aliases with an actionable migration error.
• Add security, compatibility, runtime rebinding, and persistence tests.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Performance improvement
• Tests

Testing

• Tests pass locally

• Added new tests for the changes

• full unit tier: 2570 passed, 10 skipped, 183 deselected

• focused provider/compiler/MCP/vector suite: 118 passed

• pre-commit run --all-files

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented code where the behavior is not self-explanatory
• My changes generate no new warnings
• Any dependent changes are explicitly accounted for

Part of #419 and #415. The follow-up PR adds CLI, provider-aware dependency checks, Wiki generation routes, doctor probes, and user documentation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f9df76683

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep prebuilt vector manifests loadable

When the QA registry is generated with prebuilt_dir, scripts/build_qa_index.py still writes vector entries with only embedding_model and embedding_dimension in config, relying on the loader's previous fallback to QAConfig.embedding_provider. This new unconditional call to resolve_embedding_artifact_route({ ... }) raises ValueError: invalid inference provider: '' for those manifests, so hybrid prebuilt QA datasets lose/fail their vector view at startup; either preserve the legacy provider fallback here or update the prebuilt manifest writer before requiring a provider.

Useful? React with 👍 / 👎.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.