Decide the model, provider, and deployment architecture

Define an architecture that preserves institutional control while allowing models and providers to evolve.

### Deliverables
- Provider abstraction and model-selection boundaries
- Prompt and policy versioning approach
- Deployment, tenancy, security, and observability options
- Decision record covering build-versus-buy trade-offs

### Done when
The architecture supports traceability, privacy, portability, and educator control.

No files, tests, or entry points are named. Start by mapping the provider and model-selection boundaries, then document prompt and policy versioning alongside deployment, tenancy, security, and observability options. Done means a decision record covers build-versus-buy trade-offs and the architecture supports traceability, privacy, portability, and educator control.

Written by the indexing model from the issue text.