Cut provider/ssefilter tag to unblock the openai/openaichat standalone gate

Context

PR #378 (#362, ADR 0093) shipped the LLM provider adapters as opt-in Go submodules under provider/. The GOWORK=off standalone hygiene gate (test:provider-standalone + the provider-standalone CI job) proves each provider module builds + tests with no workspace.

Because mecatl is a private/INTERNAL repo, a networked GOWORK=off build of any provider that requires another mecatl module must fetch it from the origin — and proxy.golang.org cannot serve a private module (the fetch 401s). The gate therefore runs offline (GOPROXY=off over a warmed module cache, no credential needed).

Status (updated)

• ✅ ssefilter — covered (self-contained: stdlib + openai-go).
• ✅ anthropic — covered (its require engine v0.8.0 is cache-resolvable once warmed).
• ⏳ openai + openaichat — blocked on the first provider/ssefilter/vX.Y.Z tag. They require provider/ssefilter v0.0.0, which no cache/proxy can resolve off-workspace until a real version exists. This is a one-time bootstrap gap.

What unblocks the last two

Cut provider/ssefilter/v0.1.0, bump openai/openaichat's require provider/ssefilter to it, and add both modules to test:provider-standalone + the provider-standalone CI job. (Once mecatl is open-sourced the gate can drop GOPROXY=off entirely and resolve over the network.)

See ADR 0093 ("The standalone proof runs offline").

Start with ADR 0093 and the provider/ssefilter, provider/openai, and provider/openaichat module definitions. Then inspect test:provider-standalone and the provider-standalone CI job to understand the existing offline checks. Done means publishing provider/ssefilter/v0.1.0, updating both dependent modules, and including openai and openaichat in the standalone gate.