Providers as a YAML block: a config-driven LLM registry (v1.21.0)

RFC BF ships the providers: YAML block. LLM providers stop being hardcoded in Go and become a config-declared registry with pluggable drivers. Each entry declares a compiled-in driver (anthropic / openai / gemini / deepseek / ollama / mock / code-js), a base_url, an api_key_env (env-var name resolved server-side, tenant-overridable via CredentialDef, never ${VAR}-interpolated), a max_concurrent, an options map, and a capabilities override block. Add a self-hosted vLLM / llama.cpp / groq / together / second-Ollama with a few lines; driver: openai covers any OpenAI-compatible endpoint. Every existing config keeps working byte-for-byte via an embedded default-providers layer prepended to every config; operator entries deep-merge over it. Keyless third-party providers now enable on declaration (the headline self-hosted case). anthropic/gemini/ollama drivers now forward api_key_env to KeyEnvName() so CredentialDef overrides target the right var. Per-provider max_concurrent caps in-flight runs to one provider — the motivating case is a local model on one GPU. Sub-agents gate with a deadlock carve-out. Capability overrides re-enable vision on OpenAI-compat endpoints, applied inside the driver so KeyedProvider / ThinkingDowngrader are preserved. CLI parity: validate / agents / doctor resolve from the same embedded default layer. No schema migration; adapters bump to 1.21.0 in lockstep with no code change.