security(providers): govern the provider role by the unified allow/block + stop the DISCOVERY_ERRORS leak

[fas89]

What & why

Follow-up from an adversarial re-assessment of the world-class push: the provider
role — the highest-stakes one (it emits cloud DDL / IaC) — was the only role NOT
governed by the unified plugin manager. FLUID_PLUGINS_BLOCKLIST could not block a
malicious provider, and provider discovery leaked the raw exception text + a full
traceback into DISCOVERY_ERRORS, a user-facing surface (registry_dump() /
fluid providers --debug) — the exact leak shape the other hardened paths avoid.

Changes

• _discover_entrypoints gates each provider entry-point through
  plugin_manager.is_allowed(ep.name) before ep.load(), so the same operator
  allow/block policy (FLUID_PLUGINS_ALLOWLIST / FLUID_PLUGINS_BLOCKLIST) that
  governs validators / catalog / iac plugins now governs providers too.
• _add_discovery_error records the exception type only — no raw message, no
  traceback (the full redaction-filtered detail still reaches DEBUG logs); drops the
  now-unused traceback import; the failure log is type-only too.

Built-ins are unaffected — they self-register via the curated/subpackage paths
regardless of the entry-point gate (verified).

Verification

• 422 provider tests pass (no regressions); 4 new (blocklist blocks a provider,
  allowlist excludes, DISCOVERY_ERRORS type-only with no secret/traceback).
• ruff + black==24.10.0 clean.
• Security review: no findings — reduces leak surface + closes the allow/block
  bypass; gate runs before load(); built-ins safe; no import cycle.
• Live test via fluid providers with an out-of-tree provider: discovered by
  default; FLUID_PLUGINS_BLOCKLIST=acmeprov → blocked (previously impossible).

[github-actions]

📄 Documentation Reminder

This PR appears to be missing a documentation reference. Our docs live in a separate repo.

Please update the PR description with one of:

• Link a docs PR — check the "Docs PR linked" box and paste the URL
• Mark as no docs needed — check "No docs needed" with a justification
• Acknowledge docs TODO — check "Docs TODO" and create the docs PR before merge

See the Contributing Guide for details.