refactor: centralize runtime provider policy

[Patel230]

Summary

• Move runtime provider preference, fallback, aliases, and discovery prep metadata into catalog registry provider specs
• Make runtime selection and direct fallback resolve from registry/config metadata instead of local hardcoded switches
• Add registry policy tests for preference order, OpenAI/Anthropic fallback, aliases, and discovery prep providers

Validation

• golangci-lint run --timeout=5m
• go test ./config ./catalog/registry ./runtime ./router ./setup -count=1
• go test ./... -run "^$"
• pre-push hook: govulncheck, go test ./..., go vet ./...