feat(providers): structured runtime.provider config for Copilot custom endpoints (closes #136)

[jrob5756]

Closes #136.

Summary

runtime.provider now accepts either the bare string shorthand
(provider: copilot, current behavior, unchanged) or a structured
object that forwards a ProviderConfig to the Copilot SDK's
create_session(provider=…) parameter. This lets workflows route the
Copilot SDK at OpenAI-compatible / Azure / Anthropic endpoints (Ollama,
vLLM, LM Studio, Azure OpenAI, etc.) instead of being locked to the
GitHub Copilot service.

runtime:
  provider:
    name: copilot
    type: openai            # openai | azure | anthropic
    wire_api: completions   # completions | responses
    base_url: http://localhost:11434/v1
    api_key: ${OPENAI_API_KEY}
  default_model: llama3.1

Scope agreed with the reporter: Copilot provider only this PR,
YAML + env-var fallbacks (no new CLI flags), and validate type
/ wire_api against the SDK's supported set.

Design highlights

• Activation gate – the SDK provider kwarg is only attached when
  YAML explicitly opts in (at least one field beyond name). Ambient
  OPENAI_* env vars never silently divert default Copilot
  traffic.
• Env-var fallbacks once custom routing is active:
  • base_url ← COPILOT_PROVIDER_BASE_URL → OPENAI_BASE_URL
  • api_key ← COPILOT_PROVIDER_API_KEY → OPENAI_API_KEY
  • bearer_token ← COPILOT_PROVIDER_BEARER_TOKEN
  • type defaults to openai when base_url is set
• Secrets hygiene – api_key and bearer_token are SecretStr,
  so they redact in model_dump / workflow_started payloads /
  dashboard / event logs. A redacted _describe_provider() helper
  feeds verbose logs.
• Dialog parity – _apply_provider_config() is called from both
  _execute_sdk_call (agents) and execute_dialog_turn (dialog mode)
  so all sessions hit the same endpoint.
• Validation – type / wire_api are Literal[...] (Pydantic
  enforces); azure options require type: azure;
  name != "copilot" rejects any Copilot-only field (structured
  config for other providers is explicit follow-up).
• Default-model warning – Custom endpoints rarely expose the SDK
  default gpt-4o, so the provider warns when custom routing is
  active without runtime.default_model.
• CLI override – --provider <name> replaces the entire
  ProviderSettings; logs a notice when YAML had structured fields.
  Wired into both run and resume for parity.
• Round-trip compatibility – a custom model_serializer collapses
  ProviderSettings back to a bare string when only name is set,
  so serialized YAML/JSON stays byte-compatible with the prior schema.

Files

Area	Change
src/conductor/config/schema.py	New ProviderSettings, AzureProviderOptions; RuntimeConfig rework
src/conductor/providers/copilot.py	provider_settings kwarg, _resolve_sdk_provider_config, _apply_provider_config, applied to agent + dialog paths
src/conductor/providers/factory.py	Threads provider_settings (Copilot only)
src/conductor/providers/registry.py	Forwards runtime.provider to factory only on matching name
src/conductor/cli/run.py	Redacted logging helper, override-warning, parity with resume
examples/copilot-local-llm.yaml	New: Ollama + Azure OpenAI variants
AGENTS.md	Documents the object form + env fallbacks
tests/test_config/test_provider_settings.py	New: coercion, validators, serialization, gating
tests/test_providers/test_copilot_provider_routing.py	New: resolver + plumbing + registry

Test plan

• make lint ✅
• make typecheck ✅ (only pre-existing diagnostic remains)
• make validate-examples ✅
• uv run pytest tests/ -m "not performance" -q → 2817 passed, 16 skipped, 29 deselected ✅

Out of scope (called out for follow-up)

• Structured provider config for claude / openai-agents.
• Persisting a redacted provider fingerprint in checkpoints so resume
  can warn on configuration drift.
• Per-field CLI overrides (e.g. --provider-base-url).

Credit

Inspired by @epowers's proof-of-concept
patch
attached to the issue.

[jrob5756]

Review fixes round 1 (critical + high)

Force-pushed e1416b4 with the following changes after a pre-merge review pass with the pr-review skill (6 agents: code, tests, comments, silent-failures, types, dead-code).

Critical (silent failures that masqueraded as default behavior):

• _resolve_sdk_provider_config now raises ProviderError when custom routing is activated but every resolved field is falsy (e.g. expected env vars unset). Previously returned None, silently dropping the SDK provider kwarg.
• azure block is no longer dropped when api_version: null. Schema validator rejects empty azure blocks up front; resolver always emits the block when settings.azure is not None.

High:

• Validator now rejects anchorless / empty / broken combinations that would have activated custom routing but produced unusable configs: wire_api / type / headers / azure cannot stand alone without base_url / api_key / bearer_token; empty headers, empty SecretStr, empty azure block all fail at config load.
• _warn_custom_routing_default_model now uses an explicit _default_model_explicit flag instead of comparing _default_model == "gpt-4o". Eliminates the false positive when a user picks gpt-4o deliberately and the false negative if the SDK fallback ever changes.
• Dual-credential warning moved below the env-var resolution layer so it also fires for YAML × env mixing (e.g. api_key in YAML, COPILOT_PROVIDER_BEARER_TOKEN in shell).
• Security: ambient OPENAI_API_KEY is no longer an implicit fallback for api_key. Only COPILOT_PROVIDER_API_KEY is consulted from env. Prevents accidentally sending an OpenAI dev credential to whatever base_url points at. Users who want OpenAI env behavior must opt in explicitly via api_key: ${OPENAI_API_KEY} interpolation. OPENAI_BASE_URL remains a fallback (URLs are not secrets).
• ProviderSettings is now frozen=True (custom routing is set-once at config load; eliminates the Pydantic cross-field validator drift on attribute assignment).
• Reverted unrelated getattr("model") → getattr("default_model") drive-by fix in ProviderFactory.create_provider to keep this PR scoped to Feature: Copilot Local LLM use #136. Will file separately.

Deferred to follow-ups (called out in commit msg):

• Discriminated-union refactor on ProviderSettings.name (would eliminate the cross-field validator entirely).
• Documentation-only fixes raised by the comment-reviewer (AGENTS.md wording, example YAML prose).
• Additional test-coverage gaps (registry isolation negative case, CLI override end-to-end, _describe_provider redaction test, etc.).

Verification: make lint ✅, make typecheck ✅, make validate-examples ✅, uv run pytest tests/ -m "not performance" -q → 2828 passed, 16 skipped, 29 deselected (11 new test cases over the prior 2817).