feat(ops): add rollout provider scopes

[typelicious]

What changed

• adds auto_update.provider_scope with allow_providers and deny_providers
• validates rollout provider scopes against configured provider ids
• evaluates rollout-health guardrails against the scoped provider subset instead of always using the full runtime
• exposes matched rollout providers and scoped health totals through GET /api/update
• documents the new rollout control in README, publishing, and troubleshooting docs

Why

This lets operators gate helper-driven updates against the providers that matter for a given environment, instead of having one unrelated unhealthy provider block the whole rollout.

How verified

• PYTHONPYCACHEPREFIX="$PWD/.pycache" python3 -m compileall foundrygate tests
• PYTHONPATH=. ./.venv-check-313/bin/pytest -q tests/test_updates.py tests/test_config.py
• ./.venv-check-313/bin/ruff check foundrygate/config.py foundrygate/updates.py foundrygate/main.py tests/test_updates.py tests/test_config.py
• ./.venv-check-313/bin/ruff format --check foundrygate/config.py foundrygate/updates.py foundrygate/main.py tests/test_updates.py tests/test_config.py
• /usr/bin/git diff --check