fix(ci): match the provider-registry check to the runtime identity boundary

The 0.10.3 combined batch (4cf2d2cfff) moved the four provider identity
functions into crates/runtime/src/config.rs as `pub fn`, but
scripts/check-provider-registry.py still demanded `pub(crate) fn`, so the
Lint job's provider-registry step failed on main with four "missing
canonical config identity boundary" errors. The check now names the
signatures that exist.

Verified: python3 scripts/check-provider-registry.py exits 0 ("Provider
registry drift check passed.") on a git-archive export of origin/main
9f6999f99d with this one file patched, and on the canonical working tree.
Before the patch the same export exited 1 with the four errors.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

scripts/check-provider-registry.py

@@ -219,7 +219,7 @@ def report_tui_catalog_contract(tui_config_rs: str) -> list[str]:
             errors.append(f"retired provider enum consumer: {path.relative_to(ROOT)}")
         if re.search(r"KIND_LOOKUP|FROM_KIND_LOOKUP|ProviderKind::from_kind\(", source):
             errors.append(f"retired provider ordinal bridge: {path.relative_to(ROOT)}")
-    for signature in ("pub(crate) fn active_provider_identity", "pub(crate) fn provider_identities", "pub(crate) fn resolve_provider_selection_identity", "pub(crate) fn verify_provider_identity"):
+    for signature in ("pub fn active_provider_identity", "pub fn provider_identities", "pub fn resolve_provider_selection_identity", "pub fn verify_provider_identity"):
         if signature not in tui_config_rs:
             errors.append(f"missing canonical config identity boundary: {signature}")
     descriptor_source = read(ROOT / "crates/config/src/descriptors.rs")