feat(core): mixed-provider policies — choose the provider per evaluator

Today meta.required_provider fixes one provider for every evaluator in a policy. Users need a
single policy whose evaluators use different providers over the same input — e.g. one evaluator
reading the plan through terraform_plan's typed operations, and another reaching a section the
typed provider doesn't expose through the json provider — with eval_expression combining their
results as it already does. Tracked on the public feedback board ("policy evaluations across
different tirith providers"); this is the substance of #223.

Proposal. Keep meta.required_provider as the policy-level default; allow each evaluator an
optional provider field overriding it. Validation checks that every provider used can read the
supplied input kind; the result model and eval_expression are unchanged. Distinct from "named
multi-input" (below), which adds several documents — this is several providers over one document,
and the multi-input work builds on it.

Acceptance. A policy mixing a terraform_plan evaluator and a json evaluator over one plan
file evaluates end to end, each result attributed to its provider; a provider/input-kind mismatch
is a validation error, not a runtime skip.

Start by searching for meta.required_provider, evaluator parsing, and provider/input-kind validation to trace how a policy currently selects and checks its provider. Add focused coverage for a policy combining terraform_plan and json evaluators over one input, including the mismatch validation case. Done means evaluation succeeds with each result attributed to its provider and mismatches fail validation rather than being skipped.