MCP upgrade 5/6: Trusted provider lifecycle

[Lauritz-Timm]

Part of the six-phase full MCP service upgrade.

Why

Provider trust must be configurable without losing user-owned bytes, and interrupted writes must recover deterministically.

What

• Adds lossless trust, adoption, and removal across supported provider configurations.
• Tracks exact ownership in the install manifest.
• Adds durable prepared-intent recovery and semantic conflict handling.
• Reports provider removals accurately through uninstall.

Dependency

Standalone from develop; it can be reviewed and merged independently of Core.

Verification

• Provider tests passed 20/20; manifest 15/15; document 5/5; journal 7/7.
• Init integration passed 11/11 and uninstall integration passed 8/8.
• Formatting, strict all-target/all-feature Clippy, and diff checks passed.
• The final isolated candidate evaluation passed 294/294 scenarios in each of two portable roots with normalized equality.