feat(phase-1): D10 P1 hardening — providers.enabled wiring + real streaming + spawn timeout

Folds in three production-blocking defects from external Codex review
round-3 of Phase 1 (D5+D6+D8+D9 already merged). Without these, OLP
returns 503 on every request even when `npm start` succeeds, streams
arrive as a single buffered burst after the spawn completes, and hung
CLIs block the engine forever despite ADR 0004 declaring spawn-timeout
a hard trigger.

P1.1 providers.enabled config wiring (ADR 0002 § Disable model):
- loadFallbackConfigSync() returns tri-field {chains, soft_triggers,
  providersEnabled}; server.mjs reads _startupConfig.providersEnabled
  and passes to loadProviders() at startup
- Empty / missing config → 0 enabled providers → 503 no_enabled_provider
  (matches v0.1 0-Enabled posture per ALIGNMENT.md § Provider Inventory)
- __setProvidersEnabled / __resetProvidersEnabled test seams; in-place
  Map mutation preserves existing direct-mutation patterns in Suite 13

P1.2 Real SSE streaming on single-hop cache-miss (ADR 0003 entry adapter
pattern, OpenAI /v1/chat/completions stream=true contract):
- New handleChatCompletions branch when ir.stream === true && chain.length
  === 1 && !bypassCache && !preCheckHit
- for await (const irChunk of provider.spawn(...)) writes SSE per chunk
  via res.write(irChunkToOpenAISSE(...)); accumulates streamedChunks for
  cacheStore.set on stop
- First-chunk rule preserved: error-before-first-chunk → sendError(502);
  error-after-first-chunk → truncated res.end(), no fallback
- Multi-hop chains (chain.length > 1) continue to use buffered
  executeWithFallback to keep fallback safety semantics

P1.3 Spawn timeout hard trigger (ADR 0004 § Trigger taxonomy bullet 4):
- SPAWN_TIMEOUT added to PROVIDER_ERROR_CODES (lib/providers/base.mjs)
  and HARD_TRIGGER_CODES (lib/fallback/engine.mjs)
- All three plugins (anthropic.mjs / codex.mjs / mistral.mjs) wrap drain
  loop with setTimeout (default 600_000ms, configurable via
  hints.maxSpawnTimeMs); on fire: proc.kill('SIGTERM') + reject pending
  drain promise with ProviderError(..., 'SPAWN_TIMEOUT')
- Timer cleared in finally; resolveNext/rejectNext atomically nulled in
  push() + timer-fire path to prevent late-fire double-settle

Tests 277 → 288 (+11). Suite 14 (4 providers.enabled), Suite 15
(3 streaming cache-miss real-time, including arrival-count >= 2
assertion that architecturally proves real streaming), Suite 16
(4 spawn timeout, including 2-hop chain advancement from timed-out
primary). 288/288 pass on Node 20.20.2 + Node 25.8.0.

Authorities:
- ADR 0002 § Disable model — config toggle, not plugin-removal
  https://github.com/dtzp555-max/olp/blob/main/docs/adr/0002-plugin-architecture.md
- ADR 0003 § Translation direction model — entry adapter for await pattern
  https://github.com/dtzp555-max/olp/blob/main/docs/adr/0003-intermediate-representation.md
- ADR 0004 § Trigger taxonomy + § Fallback safety (first-chunk rule)
  https://github.com/dtzp555-max/olp/blob/main/docs/adr/0004-fallback-engine.md
- OpenAI /v1/chat/completions stream=true (server-sent events,
  data: {chunk} per delta, terminator data: [DONE])
  https://platform.openai.com/docs/api-reference/chat/streaming

Reviewer (Iron Rule 10): fresh-context opus, independent of drafter.
Verdict: APPROVE_WITH_MINOR. Folded the one cheap minor before commit
(Suite 15a arrival-count assertion strengthened from chunks.length > 0
to arrivalTimestamps.length >= 2 — the prior assertion would have
admitted a buffered impl). Two remaining non-blocking notes deferred:
optional writeHead deferral (low value; single-hop guard makes pre-
content 200 + empty body safe), and version bump (Phase 1 ships as
v0.1.0 aggregate when D11–D16 land).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/fallback/engine.mjs

@@ -40,6 +40,7 @@ const HARD_TRIGGER_CODES = {
   CLI_NOT_FOUND: true,
   AUTH_MISSING: false,   // user config problem — never fall over (ADR 0004 § Decision)
   OUTPUT_PARSE_ERROR: true,
+  SPAWN_TIMEOUT: true,   // ADR 0004 § Trigger taxonomy bullet 4: spawn timeout is a hard trigger
 };
 
 /**
@@ -444,17 +445,20 @@ function defaultConfigPath() {
 }
 
 /**
- * Loads fallback chain configuration from ~/.olp/config.json (or the given path).
+ * Loads the full OLP config from ~/.olp/config.json (or the given path).
  *
  * Per D9 implementation notes:
  *   v0.1 ships with no config file. Fallback engine is wired but single-hop
  *   until the user populates routing.chains.
  *
- * Returns empty config (no chains, no soft triggers) if the file is absent,
- * unreadable, or malformed.
+ * Per ADR 0002 § Disable model: providers.enabled is the toggle that transitions
+ *   a Candidate provider to Enabled. Missing entries default to false (disabled).
+ *
+ * Returns empty config (no chains, no soft triggers, no enabled providers) if the
+ * file is absent, unreadable, or malformed.
  *
  * @param {string} [configPath] — override path (for testing — do NOT write to ~/.olp/config.json in tests)
- * @returns {{ chains: object, soft_triggers: object }}
+ * @returns {{ chains: object, soft_triggers: object, providersEnabled: Record<string, boolean> }}
  */
 export function loadFallbackConfigSync(configPath) {
   try {
@@ -462,12 +466,15 @@ export function loadFallbackConfigSync(configPath) {
     const raw = readFileSync(path, 'utf8');
     const parsed = JSON.parse(raw);
     const routing = parsed?.routing ?? {};
+    const providers = parsed?.providers ?? {};
     return {
       chains: routing.chains ?? {},
       soft_triggers: routing.soft_triggers ?? {},
+      providersEnabled: providers.enabled ?? {},
     };
   } catch {
     // File absent, unreadable, or malformed → no fallback config (single-hop mode)
-    return { chains: {}, soft_triggers: {} };
+    // Empty providersEnabled → all providers disabled → 503 per ALIGNMENT.md v0.1 posture.
+    return { chains: {}, soft_triggers: {}, providersEnabled: {} };
   }
 }