feat: add provider instance configuration foundation

[shivros]

Summary

• Add generic default + named provider-instance configuration and instance-aware registry construction.
• Preserve legacy IRIS_<TYPE>_<FIELD> defaults; support IRIS_<TYPE>__<INSTANCE>__<FIELD> for named instances.
• Scope provider runtime IDs and audit/idempotency identity to the configured instance while retaining static provider-type metadata.

Verification

• cargo build --all-targets
• cargo test -p iris-providers (99 tests)
• cargo test --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check

imap-proto emitted its pre-existing future-incompatibility warning; all gates passed.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra

Initial review blocked direct TOML validation. Fixed: IrisConfig::from_toml now validates provider/instance identifiers before returning; regression coverage asserts rejection at parse time.

Reviewer B — Gemini 3 Flash

Initial review blocked a named-only env selection that could synthesize an enabled default provider. Fixed: newly created provider roots start disabled when selecting type.instance; regression coverage proves legacy default env fields do not enable the default.

A prior panel finding on collapsed audit provenance was also fixed: provider-originated audit events and record_once keys are scoped to the configured instance ID. Public generated provider/result attribution is deliberately deferred by COD-458's stated scope.

Final required gates passed after the fixes: workspace build, provider tests (99), full --all-targets suite, strict Clippy, fmt, and codegen freshness.

[shivros]

Auto-Merge Gate — approved for squash merge

Confidence: 0.91

The implementation directly satisfies COD-458's configuration/registry foundation: it separates configured instance IDs from static provider types, preserves the default-provider compatibility path, scopes named environment overlays, validates identifiers at parse and resolution boundaries, and keeps public generated surfaces/deployment out of scope.

Evidence: all six GitHub CI checks passed (Test, Format Check, Clippy, Secret Scan, Dependency Audit, Creed context drift). The review panel's earlier correctness findings have explicit regression coverage in the final diff; no unresolved review activity remains. Independent local cargo test -p iris-providers passed (99 tests). The broader local gate could not complete because /tmp exhausted its tmpfs during compilation; GitHub's complete CI remains green.

Scope limit: this approval applies only to the COD-458 registry/configuration foundation, not a live deployment or public generated-schema change.