refactor(provider): certify typed write ownership

Freeze prerequisite A as a component-level certification unit. Add the immutable v5 certification suite, split create/update row DTOs, preserve immutable creation time, map strict-create races to AppError::Conflict, make aggregate compensation insert-or-restore, and enforce reconcile preconditions through a single-lock transaction primitive.

Old save_provider callsite classification remains exhaustively recorded in 4f78451405575158ff6562c7021c7f31f2860780; this checkpoint does not add or reclassify an omitted legacy callsite. It tightens the remaining reconciliation classifications there: default live import is [create]; OpenCode/OpenClaw/Hermes existing branches are [update] and absent branches are [create]; universal Claude/Codex/Gemini branches are [create/update] selected from an observed fingerprint. The sealed compensation helper remains the only [restore] path. The old reconcile_provider_record symbol is deleted.

Remaining update_provider_settings_config callsites are classified as [update]: codex_history_migration updates an already-read Codex row; proxy token synchronization updates already-read Claude, Codex, Gemini, and GrokBuild rows. Each now uses ProviderKey plus ProviderRowUpdate, explicitly removes hydrated endpoint projections, preserves endpoint authority, and fails on a missing row instead of silently succeeding.

tests/fixtures/pi/provider-write-api-v1.json

@@ -3,12 +3,12 @@
   "codeAuthority": "src-tauri/src/database/dao/provider_write.rs",
   "types": {
     "ProviderKey": ["app_type", "id"],
+    "ProviderRowCreate": ["content", "created_at"],
     "ProviderRowUpdate": [
       "name",
       "settings_config",
       "website_url",
       "category",
-      "created_at",
       "notes",
       "meta",
       "icon",