fix(codegen): bind qualified flux provider packs (ADC-682)

[wolf75222]

Re-audit result

ADC-682 is not fully complete on current origin/master, despite its Linear status. This draft closes a bounded source/compiler-provider slice only.

What this changes

• resolve one canonical ComponentProviderPacks contract for both Model and Module compilation routes;
• bind that contract through an explicit compiler-emitter protocol;
• attach the exact pack to the actual formula carrier (model._m), not only to the public facade;
• derive physical-flux field requirements transitively from primitive definitions;
• select only required components using exact owner/space identity;
• fail closed on missing or ambiguous homonymous providers;
• emit provider availability in the generated qualified ABI metadata.

The commit history is intentionally thematic:

1. 61bd2f3a — production implementation;
2. d7b34014 — focused qualification and regression proofs.

Validation

• Ruff targeted: clean
• Python compile checks: clean
• provider/compiler tests: 39 passed, then 35 passed after final review
• module lowering subset: 8 passed, 2 deselected
• physics/architecture batch: 33 passed
• source-isolated module codegen/hash/manifest/operator scripts: passed
• docs lint: OK (41 Markdown files, 11 docmap entries)
• git diff --check: clean

No shared build or install was modified. Native-extension tests that require a loaded source _pops contract were intentionally not claimed in this isolated source-only lane.

Explicitly still open in ADC-682

• PhysicalFluxView still reconstructs the legacy global Aux object, including positional/global extra slots;
• the native binder does not yet consume and authenticate flux_provider_requirements;
• same-model, different-block instance qualification is not yet carried end-to-end through the native ABI;
• CPU/GPU and Uniform/AMR logical-signature parity is not yet proven;
• the full native acceptance matrix still needs an isolated native build.

Therefore this PR must not auto-close ADC-682. It is a source-only, fail-closed foundation for the remaining native cutover.