Provide secure multi-target OpenShell providers for Switchyard routing

Parent Epic: #7937

## Outcome

Switchyard judge, weak, and strong targets resolve to distinct OpenShell-managed provider identities without placing raw provider credentials in the sandbox or permitting direct-provider bypass.

## Proposed V5 decision

Use three separately attached OpenShell providers for the first released-path integration:

- judge/classifier;
- weak/efficient; and
- strong/capable.

Keep inference.local as Hermes's ordinary bootstrap/default route. Do not use it for Switchyard targets: the current gateway-wide inference route selects one host model and cannot represent two simultaneous target models plus a judge.

Canonical NemoClaw scope was accepted in #7937 on 2026-08-13. This recommendation defines the initial provider boundary, but it does not authorize activation or a support claim before the remaining release and qualification gates pass.

## Provider bundle contract

NemoClaw should provision the bundle against the final OpenShell gateway and attach all three providers to the sandbox create/rebuild plan as one activation unit.

For each provider, the gateway-authored receipt or attestation must identify:

- provider ID, resource version, type, workspace, and resolved profile revision;
- a versioned digest of canonical non-secret endpoint/configuration data;
- credential and configuration key names, never values; and
- the sandbox-local provider endpoint used by the generated Switchyard llm_client.

NemoClaw generates Switchyard llm_clients and targets only from that committed evidence. Each llm_client receives an endpoint-scoped raw-key placeholder through api_key_env; Switchyard constructs the provider Authorization header. Set forward_auth = false so caller authorization cannot reach the judge or selected target.

Provider names are labels, not security identities. Any partial create or attach leaves routing inactive and rolls back or quarantines the incomplete bundle. No provider request may occur until all three identities and bindings are attested.

## Current OpenShell gate (2026-08-27)

OpenShell v0.0.113 is released, but NVIDIA/OpenShell#2722 remains open. The current CLI cannot bind an update atomically to a previously observed provider ID plus resource version, and the read surface does not expose a stable endpoint/profile attestation.

OpenShell PR #2962 now proposes making built-in or imported provider profiles authoritative while retiring legacy public provider workflows. That direction aligns with this issue's declarative judge/weak/strong profiles and means NemoClaw must not depend on the legacy `generic` creation path. The PR is still open with a non-green required gate and does not implement #2722's conditional mutation or attestation contract.

Therefore the initial milestone is deliberately narrow:

- qualify fresh creation of uniquely named judge, weak, and strong providers;
- do not claim safe reuse, update, credential rotation, or mutation of existing provider records;
- fail closed when a requested name already exists or its identity cannot be proven; and
- keep mutation/rotation blocked until #2722 or an accepted equivalent contract is released and qualified.

This fresh-only boundary remains intentionally narrower than the final lifecycle contract and may be tightened by security review.

## Scope

- Define stable semantic target identities for judge/classifier, weak/efficient, and strong/capable.
- Transactionally create and attach the three-provider bundle against the final gateway authority.
- Translate only attested OpenShell endpoint/model identities into Switchyard llm_clients, targets, and routes.
- Keep raw provider credentials behind OpenShell placeholder rewriting.
- Deny caller-auth forwarding, cross-provider placeholder use, and direct-provider bypass.
- Keep the Switchyard path inactive when any provider, receipt, route, or policy binding is missing or inconsistent.
- Validate two real target models and canonical routing evidence end to end.

## Acceptance

- [ ] A fresh onboarding flow creates and attaches judge, weak, and strong as one bundle with no manual credentials-add loop.
- [ ] Two simultaneous real model targets return distinguishable, recorded responses.
- [ ] Classifier/judge traffic uses its separately declared provider when the router requires it.
- [ ] Switchyard target configuration contains no inference.local endpoint.
- [ ] Raw provider credentials are absent from sandbox environment, files, argv, logs, errors, telemetry, and captured artifacts.
- [ ] Caller-supplied authorization cannot reach or replace a gateway-owned credential; forward_auth remains false.
- [ ] Each placeholder resolves only at its approved provider endpoint; cross-endpoint use and direct-provider bypass are denied.
- [ ] Missing, partial, stale, duplicate-name, or unattestable provider state fails before routing activation or any provider request.
- [ ] Existing-provider mutation, reuse, and credential rotation remain rejected until identity-bound CAS and secret-free endpoint/profile attestation are available and qualified.
- [ ] Removing or losing one provider produces an explicit unavailable state rather than silent fallback to inference.local or another target.