feat: provider fallback + per-project config (0.7.0)

[blackaxgit]

Summary

CLX 0.7.0 — automatic primary→secondary LLM provider fallback with per-capability cooldown, plus per-project config overrides via figment-layered loading.

Reverses the 0.6.x design's explicit "no automatic fallback" decision based on user feedback that default_decision: allow-style silent degradation under Azure outage is unsafe for a risk-scoring CLI.

What's new

• Per-capability fallback — llm.chat.fallback and llm.embeddings.fallback config blocks. Fall back on transient errors (Connection, Timeout, RateLimit, 5xx, 408); fail-fast on terminal errors (Auth, DeploymentNotFound, ContentFilter). Fallback's model overrides the caller's model name (providers don't share identifiers).
• 30-second cooldown after a fallback event — primary is skipped so sustained outages don't pay the latency penalty of always retrying.
• Per-project config at <repo>/.clx/config.yaml, walk-up discovery from CWD to $HOME. Env-var escape: CLX_CONFIG_PROJECT=/path or CLX_CONFIG_PROJECT=none.
• Layered config loading via figment (defaults → global → project → env vars).
• Inert-keys allowlist — project configs may override routing/threshold keys; security-sensitive keys (providers.*, logging.file, validator.enabled) are silently dropped with a WARN.

Architecture

• New LlmClient::Fallback(FallbackClient) enum variant. FallbackClient { primary: Box<LlmClient>, fallback: Box<LlmClient>, fallback_model, last_primary_failure }. Implements LlmBackend itself; single insertion point at the factory; zero production call sites changed.
• is_transient promoted to LlmError::is_transient method (was a free function in azure.rs). Backends and the new fallback wrapper share one predicate.
• New crates/clx-core/src/config/project.rs for walk-up + allowlist filter.
• Config::load switched from raw serde_yml::from_str to figment::Figment with Yaml::file + Yaml::string (filtered project) + Env::prefixed("CLX_").

Backwards compatibility

• ✅ No fallback: field anywhere → behavior bit-for-bit unchanged.
• ✅ No project file → behavior bit-for-bit unchanged (figment with one layer ≡ today's serde_yml::from_str).
• ✅ Legacy ollama: block auto-translation (0.6.0) preserved.
• ✅ CLX_LLM_CHAT_* env-var shortcuts still work.

Tests

• 3 new wiremock tests in llm/fallback.rs: fallback-on-503, no-fallback-on-401, cooldown-skips-primary.
• 4 unit tests for project_config_path + filter_inert_only in config/project.rs.
• 2 integration tests for layered loader in config::schema_tests.
• All existing tests preserved (884+ passing in workspace).

Deferred to v0.7.x (not in this PR)

• clx trust <repo> UX command for promoting non-inert project keys past the allowlist.
• Multi-fallback chains (fallback: [a, b, c]).
• Cross-process cooldown persistence.

Test plan

• cargo build --release --workspace — clean
• cargo clippy --workspace --all-targets --all-features -- -D warnings — clean
• cargo test --workspace — 884+ pass
• cargo fmt --all -- --check — clean
• cargo audit — exit 0
• CI green on the PR
• Real-tenant fallback smoke test from CONTRIBUTING.md after merge

Spec & plan

• Design: specs/2026-04-30-provider-fallback-design.md
• Plan: specs/plans/2026-04-30-provider-fallback.md