fix(provider): resolve OPY releases through R2

[Teakowa]

Summary

• resolve the current first-party OPY provider version from releases.wrightkit.dev/opy-rs/latest/version
• download provider archives/checksums only from immutable opy-rs/releases/<version>/... paths
• update the existing local provider regression server so wrong R2 path shapes return 404 instead of silently passing

Verification

• existing offline reuse and failed-integrity preservation behavior remains unchanged
• R2-shaped clean-bootstrap and Windows provider tests require exactly one latest pointer request plus archive/checksum requests under /opy-rs/releases/
• ablation: restoring either the GitHub JSON parser or /v<version>/ artifact path causes the R2-shaped regression server to fail

Dependency

Blocked on wrightkit/opy-rs#229 / PR #230 publishing the owner-side opy-rs/latest/version contract. Production clean-bootstrap smoke should remain red until that pointer exists; do not bypass it with a test-only provider injection.

Fixes #286