core: single-source provider metadata (#19) + resolve config once per call (#15)

[ernestprovo23]

Core call-path cluster (Wave 2). Two tech-debt items in the provider call path, implemented serially. No changes to council.py, cli.py, transport.py, or adapters/ (owned by parallel clusters).

closes #19
closes #15

#19 — single source of truth for provider metadata (KeyError escape)

Provider metadata was split: env-var names in registry.PROVIDER_ENV_VARS, URLs in adapters.openai_compat.OPENAI_COMPAT_URLS. The two could silently drift; a half-declared OpenAI-compatible provider surfaced as a runtime KeyError in adapters._openai_compat_adapter that escaped the ProviderError handler into the broad except Exception.

• registry.py is now the single source of truth: OPENAI_COMPAT_PROVIDERS (prefix -> URL + env vars, via a frozen OpenAICompatProvider) and NATIVE_PROVIDERS are the authoritative tables. PROVIDER_ENV_VARS is derived from them, so it can never desync.
• New RegistryError + _assert_metadata_consistent() runs at import time and fails loudly if adapters.OPENAI_COMPAT_URLS ever drifts from the registry (extra/missing prefix, URL mismatch, or a URL with no env var). The former silent per-call KeyError becomes an immediate, diagnosable startup error.
• adapters/ was intentionally left untouched (parallel cluster owns it); the import-time guard is the in-bounds mechanism that makes drift impossible to ship.
• Per-provider edit step documented in the registry module docstring.

#15 — call_model re-read config from disk on every call (caching blocker)

call_model called load_config() per invocation (~13 disk reads + YAML parses in a 4x3 debate + synthesis).

• call_model gains an optional config param (default None, fully backward compatible). When injected it's used directly; when omitted it falls back to a now-memoized load_config.
• load_config memoizes by (path, mtime): self-invalidates when the file changes (preserves always-fresh-across-edits behavior), serves repeated same-file calls from memory. clear_config_cache() added for tests/long-lived processes.
• The memoization removes the per-call disk read without threading config through council.py, so council.py/cli.py/transport.py/adapters stayed untouched. The public call_model signature is unchanged for existing callers (new param is keyword-only, optional).

Tests (79 passed; 68 baseline + 11 new)

• provider metadata split across two files can silently drift (KeyError escape) #19: PROVIDER_ENV_VARS derived from the single source; every compat provider has env vars; registry/adapter URL tables in sync; import-time guard detects url-drift, missing-url, and url-mismatch.
• call_model re-reads config from disk on every call (hot path + caching blocker) #15: injected config means load_config is never called; standalone calls read disk at most once over a 13-call burst; cache invalidates on mtime change; a full Council.ask run hits disk at most once.
• ruff check . and ruff format --check . clean.

🤖 Generated with Claude Code